Security Engineer, GRC
Core
Build and scale Governance, Risk, and Compliance (GRC) programs supporting commercial audits, federal compliance, security risk management, vendor risk, and policy management.
Role type
Senior GRC Security Engineer (Program Management)
Builds
Reliable GRC workflows, control activities, policies, and automated/AI-assisted compliance processes.
Domain
Cybersecurity, GRC, Federal Compliance (FedRAMP, CMMC), AI Integration
Required skills
GRC program management, security/compliance frameworks (SOC 2, ISO 27001, NIST 800-53, CMMC, FedRAMP, PCI DSS), GRC platforms (Drata, Tines, Vanta, ServiceNow, Archer, LogicGate, Secureframe), automation (APIs, scripts, webhooks), AI tooling and validation, cross-functional partnership, evidence generation and validation, risk monitoring, project management.
Preferred skills
Experience with Third-Party Assessment Organization (3PAO) coordination, Plans of Action and Milestones (POA&Ms), continuous monitoring, remediation, AI-assisted coding or workflow configuration.
Technologies
Drata, Tines, Vanta, ServiceNow, Archer, LogicGate, Secureframe, APIs, scripts, webhooks, cloud integrations, identity integrations, AI tools.
Responsibilities
Manage GRC initiatives spanning commercial and federal compliance; support planning, assessment preparation, remediation, and continuous monitoring for FedRAMP/CMMC/NIST; partner with control owners, Security, Engineering, Legal, and auditors to gather evidence and resolve gaps; define and improve evidence generation, validation, and tracing; monitor control health, configuration drift, and remediation progress; build or configure automated and AI-assisted workflows; maintain project plans, risk logs, and documentation.
Seniority
Senior, hands-on IC with program management responsibilities.
