GRC Engineer
Core
Maintain GRC program, keep company audit-ready, assess third-party risk, and automate evidence collection for a SaaS platform.
Role type
GRC Engineer (Security team)
Builds
Control frameworks, audit evidence, risk registers, and compliance automation integrations
Domain
SaaS / Cloud Security
Deliverable
dashboards & analysis
Required skills
GRC frameworks (SOC 2, ISO 27001, NIST), audit management, risk assessment, third-party risk management, compliance automation, cloud security controls
Preferred skills
AI Governance frameworks, HIPAA/FedRamp experience, global team collaboration, CISA/CRISC/Security+ certifications
Technologies
GRC tools, scripting/workflow automation tools
Responsibilities
Maintain control frameworks and map controls to standards; Track control ownership and health; Meet with control owners to address gaps; Scope and execute internal/external audits; Collect and review evidence for compliance; Track audit findings and remediations; Perform security reviews of third-party vendors; Draft and maintain security policies and procedures; Answer customer security questionnaires; Manage risk register including exceptions and expiry; Build integrations for evidence collection and control monitoring
Seniority
Mid-Senior (5+ years experience)
