GRC Security Engineer
Core
Senior GRC Security Engineer driving compliance programs, risk management, and third-party security reviews to build trust and operational rigor for a cybersecurity SaaS company.
Role type
Senior hands-on individual contributor GRC Security Engineer
Builds
Robust tooling and workflow engine to automate GRC activities at scale
Domain
Cybersecurity / SaaS / Compliance
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
ISO 27001 program management, SOC 2 Type II maintenance, risk assessment and treatment, third-party security reviews, security awareness program leadership, stakeholder engagement, technical fluency for tool assessment, automation of GRC workflows
Preferred skills
SOC 2 Type II experience, third-party risk management in SaaS, Vanta or similar GRC automation platforms, AI governance topics
Technologies
Vanta, AI tools
Responsibilities
Drive day-to-day execution of ISO 27001 program including evidence collection and audit preparation; Maintain SOC 2 Type II program controls and follow-up actions; Run risk management process including assessments, workshops, and remediation planning; Handle third-party security reviews for internal tools and vendors; Lead security awareness program including training and phishing simulations; Act as security partner for Legal, HR, Finance, and Business Operations; Support Sales with security questionnaires and audit representation
Seniority
Senior, hands-on IC