Senior Security Engineer, GRC
Core
Primary owner of the customer-facing compliance program, managing security questionnaires, due diligence, and compliance reviews to ensure customer confidence in security posture.
Role type
Senior GRC Security Engineer (Customer-Facing)
Builds
Evergreen response libraries, automations for compliance validation, dashboards for program health, and third-party risk assessment workflows.
Domain
Enterprise Security, Governance, Risk, and Compliance (GRC)
Deliverable
production ML models | product features | dashboards & analysis | client delivery | infrastructure
Required skills
GRC and information security compliance expertise, hands-on experience with SOC2/ISO 27001/HIPAA/PCI-DSS, managing high-volume security questionnaires, scripting and automation (Python/Bash), customer-facing communication, risk management principles, translating technical controls to business language.
Preferred skills
Security certifications (CISSP/CISM/CRISC/CISA/CCSP), experience with GRC platforms (Vanta/Drata/Sprinto), familiarity with NIST CSF/800-53, background in SaaS/fintech/healthcare, drafting DPAs/BAAs.
Technologies
Python, Bash, Vanta, Drata, Sprinto, SOC2, ISO 27001, HIPAA, PCI-DSS, FedRAMP, SIG, CAIQ, NIST CSF, NIST 800-53
Responsibilities
Own intake and completion of inbound security questionnaires and due diligence requests; serve as primary customer-facing representative for security and compliance; build and maintain compliance response libraries; automate compliance posture validation and auditor coordination; design dashboards for leadership visibility; design and automate third-party risk assessment processes; perform ongoing risk assessments and maintain risk registers; author and operationalize security policies; coordinate customer security review meetings; collaborate cross-functionally to resolve compliance gaps.
Seniority
Senior, hands-on IC with strategic partnership focus