4745-Security Engineer II (GRC)
Core
Security Engineer responsible for Governance, Risk & Compliance (GRC) activities including security questionnaires, RFPs, vendor risk management, audits, and regulatory compliance across healthcare and public-sector environments.
Role type
Senior GRC Security Engineer
Builds
Security policies, compliance frameworks, audit evidence, and risk mitigation plans for customers and internal operations
Domain
Healthcare, Public Sector, Cybersecurity, Regulatory Compliance
Deliverable
dashboards & analysis
Required skills
GRC frameworks (HIPAA, SOC 2, ISO 27001, HITRUST), Vendor Risk Management, RFP/Security Questionnaire response, Risk Assessments, BIA, Disaster Recovery, Audit coordination, Policy development, Cloud security (AWS/Azure/GCP), US Federal/State compliance (FedRAMP, NIST), AI governance (ISO 42001, NIST AI RMF)
Preferred skills
CISA, CRISC, ISO 27001 LA/LI certifications
Technologies
AWS, Azure, GCP, NIST SP 800-53, FedRAMP, GovRAMP, SOC 2, HIPAA, HITRUST, ISO 27001, ISO 42001
Responsibilities
Respond to RFPs and security questionnaires; Coordinate with cross-functional teams on security exhibits and compliance queries; Perform risk assessments, BIAs, and tabletop exercises; Analyze and update security and privacy policies; Support implementation of privacy and security controls; Drive vendor and third-party risk assessments; Support internal and external audits (SOC 2, HIPAA, HITRUST, ISO 27001, FedRAMP); Maintain POA&M, risk registers, and control gaps; Support continuous monitoring and evidence collection; Identify control gaps and formulate remediation plans; Support AI governance initiatives.
Seniority
Mid-Senior, hands-on IC
