Senior GRC Engineer

Overview

Design, scale, and automate security governance, risk, and compliance (GRC) frameworks, bridging compliance requirements and technical execution through automation for frameworks such as NIST and ISO standards.

What you'll do

• Build and maintain scalable, reusable security and compliance control libraries across the organization.
• Translate complex regulatory and industry standards into standardized, actionable control definitions.
• Map evidence requirements across overlapping compliance frameworks to eliminate redundancy and support the ISO and NIST Risk Management Frameworks.
• Define standardized evidence artifacts, validation logic, and assessment criteria for automated control evaluation.
• Partner with engineering and security teams to build automated evidence collection pipelines and continuous compliance monitoring.
• Build compliance content and metadata rule libraries using structured data formats (JSON/YAML) to scale platform capabilities.
• Drive the practical design, implementation, and mapping of NIST (CSF / SP 800-53 / RMF / SOC 2) and ISO 27001/27002 control frameworks across technical environments.
• Define clear implementation guidance, control validation criteria, and self-assessment objectives for technical teams.
• Continuously refine GRC workflows, tooling, and framework content as standards and organizational needs evolve.

What you'll need

• Required hands-on experience implementing, operationalizing, and mapping ISO 27001/27002 and NIST SP 800-53 / NIST CSF / NIST RMF frameworks.
• Demonstrated ability to prepare technical environments and control owners for external audits through structured evidence management and control readiness models.
• Deep understanding of ISO and NIST Risk Management Frameworks, including risk assessment methodologies, control testing, and remediation workflows.
• Understanding of cloud platforms (AWS, Azure, or GCP), Identity and Access Management (IAM), and core security technologies.
• Experience working with structured data formats (JSON, YAML) to define validation logic or control metadata.
• Familiarity with evidence mapping, automated evidence validation, and modern compliance testing concepts.
• Ability to decompose complex regulatory texts into clear, practical engineering specifications.
• Excellent technical communication skills with the ability to bridge conversations between technical engineers, product teams, and management.
• High attention to detail in defining control definitions, test procedures, and architectural mappings.

Nice to have

• Experience with PCI DSS, SOC 2, and CIS Controls.
• Industry certifications such as CISA, CRISC, CISM, or CISSP.
• Hands-on experience with GRC automation platforms (e.g., ServiceNow GRC, Vanta, Drata, Anecdotes, or custom GRC platforms).
• Background in software engineering, security engineering, or compliance automation.