GRC Engineer

Job description

Job responsibilities

• Own day-to-day GRC operations - including (but not limited to) performing risk assessments, driving continuous compliance programs, automating control monitoring and evidence collection, and completing third party…
• Perform and improve security risk assessments, maintain the risk register, partner with risk owners to drive risk remediation and mitigation
• Own the third-party risk management lifecycle, including vendor intake, risk-based tiering, security assessments, due diligence, ongoing monitoring, and remediation.
• Establish automated control monitoring systems and continuous compliance workflows to maintain real-time audit readiness and work with control owners towards continuously strengthening security posture
• Administer GRC platforms (e.g., Vanta, Anecdotes, Drata, OneTrust) with a focus on automation and scalability
• Deep hands-on experience with major security and privacy frameworks such as ISO42001, NIST AI RMF, ISO27001/17/18, TISAX, SOC 2 or NIST CSF
• Support AI governance initiatives aligned with ISO 42001 and NIST AI RMF, translating requirements to practical controls, assessments, and evidence
• Maintain and update security policies and standards aligned with industry best practices

Job requirements

• Bachelor’s or Master’s in Information Security, Computer Science, Engineering, or a related field.
• 5–8 years of experience in security GRC, risk management, or compliance program ownership.
• Active security certification (e.g. CISSP, CISA, CISM, AIGP, ISO 27001 Lead Auditor)
• Proven experience building scalable GRC automations using AI agents, custom tooling, or scripting.
• Strong organizational skills and ability to manage multiple priorities under tight deadlines.
• Strong written and verbal communication skills with technical execution rigor.