GRC Engineer

. Own SOC 2 Type II and HIPAA end to end, including scoping, control design, evidence, auditor walkthroughs, and remediation .

Posted 9/25/2026full-timeRemoteMid-LevelSeniorWebsite

Tools & technologies

CloudGoogle Cloud PlatformSDLC

Key responsibilities & impact

Own SOC 2 Type II and HIPAA end to end, including scoping, control design, evidence, auditor walkthroughs, and remediation
Scope and lead the next compliance framework, likely ISO 27001, based on customer requirements
Build and maintain integrations feeding the GRC platform from cloud providers, SaaS tools, and internal systems
Convert controls into continuous checks using policy-as-code, configuration drift detection, and a control-failure pipeline
Run the vendor security review program from intake through periodic re-review
Own the security questionnaire and trust center workflow
Maintain the risk register and conduct risk assessments producing documented decisions
Embed compliance requirements into the SDLC and change management through tooling
Reduce manual work required to pass quarterly audits

What you’ll need

5+ years in security, with demonstrated experience building automation for a GRC or compliance program
Technical ownership of at least one SOC 2 Type II or ISO 27001 audit
Ability to write code and use LLMs productively without lowering quality
Hands-on experience with a GRC platform's API
Cloud IAM and configuration expertise on at least one provider; GCP preferred
Ability to determine sufficient evidence and defend an automated test to an auditor
Ability to scope, prioritize, and ship independently in a small security engineering team
Strong writing skills for policies, control narratives, and questionnaire answers
Experience at an all-remote company is a nice-to-have
Production experience shipping LLM or agentic workflows for compliance work is a nice-to-have
Experience at a developer-tools company is a nice-to-have

Comp & perks