GRC Engineer

Overview

Gainsight is hiring a full-time GRC Engineer on the Security team, reporting to the Director of Security, to maintain the company's governance, risk, and compliance program and keep it audit-ready.

What you'll do

• Maintain multiple control frameworks and map controls to standards
• Track control ownership and health
• Meet with control owners to address gaps in controls
• Scope internal and external audits
• Work with auditors through the audit process from kick-off to completion
• Collect and review evidence for all frameworks to ensure compliance and traceability
• Track audit findings and remediations to completion
• Perform security reviews of all third-parties and vendors
• Track vendor remediation items and maintain the vendor inventory
• Draft, update, and maintain all security policies, procedures, and standards regularly
• Answer customer security questionnaires and requests
• Support customer audits and provide compliance documentation where required
• Manage the risk register including exceptions, acceptance, and expiry
• Build and maintain integrations and automation for evidence collection and control monitoring
• Work with engineering teams to align technical controls to business requirements

What you'll need

• 5+ years of experience in GRC, security compliance, IT audit, or risk management, ideally within a SaaS or cloud-based company
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, and NIST, including how to map controls across them
• Experience supporting external audits and assessments, including scoping, evidence collection, walkthroughs, and tracking findings through remediation
• Experience performing risk assessments, maintaining a risk register, and reviewing the security posture of third-party vendors
• Familiarity with compliance automation or GRC tools, and experience implementing security automation such as scripting or workflow tools that automate recurring evidence collection and control monitoring
• Understanding of cloud infrastructure and common security controls (access management, logging, encryption, change management) sufficient to evaluate evidence and discuss it with engineers
• Clear written and verbal communication, with the ability to explain control requirements and risk to technical and non-technical teams and to manage several deadlines at once

Nice to have

• Experience with AI governance frameworks
• Previous experience in highly regulated industries that require HIPAA or FedRAMP
• Experience working with globally distributed teams
• Security certifications such as CISA, CRISC, or Security+

Details

• Fully remote role based in Mexico
• Occasional travel of up to 10-25% for team meetings, training, or company events