GRC Engineer

Role overview Maintain and improve a governance, risk, and compliance programme for a cloud based software environment. The GRC Engineer helps keep the organisation audit-ready by coordinating controls and assessments, managing risk and vendor reviews, and making evidence collection more reliable through automation. The position is remote from Mexico and works across Security, Engineering, IT, and Legal.

Responsibilities - Maintain control frameworks and map controls across standards; track ownership, health, and remediation of gaps. - Scope internal and external audits, coordinate evidence and walkthroughs, and follow findings through to closure. - Assess third-party and vendor security, maintain the vendor inventory, and track remediation items. - Draft and update security policies, procedures, and standards; manage risk register entries, exceptions, and expiry dates. - Respond to customer security questionnaires and support customer audits with compliance documentation. - Build integrations or workflow automation for evidence collection and control monitoring, working with engineers to align technical controls with business needs.

Requirements - At least five years of experience in GRC, security compliance, IT audit, or risk management, ideally in SaaS or cloud environments. - Working knowledge of SOC 2, ISO 27001, and NIST, including control mapping. - Experience supporting external audits from scoping and evidence gathering through findings remediation. - Background conducting risk assessments, managing a risk register, and reviewing vendor security. - Familiarity with GRC or compliance automation tools and implementing automation for recurring evidence or monitoring tasks. - Understanding of cloud infrastructure and controls such as access management, logging, encryption, and change management; clear communication and ability to manage concurrent deadlines.

Nice to have - Experience with AI governance, HIPAA or FedRAMP environments, or globally distributed teams. - CISA, CRISC, Security+, or a similar security certification.

Benefits and work setup - Remote role based in Mexico; occasional travel may be required, potentially up to 10–25%. - The source describes career development and mentoring opportunities.