Senior Security GRC Engineer

What you'll do

Risk Management

• Perform risk assessments and process incoming risk questions and intake requests
• Maintain the risk register, keeping entries accurate, current, and well documented
• Track risk treatment plans and follow up with owners on progress
• Manage the exceptions and issues tracking process, including intake, documentation, expiration follow-up, and reporting
• Support third-party risk activities, such as vendor assessments, questionnaire review, and tracking remediation

Compliance and Audit

• Coordinate evidence collection from control owners and chase outstanding requests
• Help prepare control owners and stakeholders for audit interviews
• Keep the SOC 2 system description, ISMS documentation, and Statement of Applicability (SoA) up to date
• Track audit gaps and findings and drive remediation to closure with control owners

Security Program Support

• Help GRC and partner teams run governance for the Secure Software Development Lifecycle (SSDLC), including tracking adoption, gathering evidence, and maintaining supporting standards
• Support data classification and data governance efforts by maintaining documentation, tracking adoption, and coordinating with data owners
• Assist with business impact analysis (BIA) and business continuity/disaster recovery (BC/DR) activities, including plan maintenance, exercise coordination, and follow-up on gaps
• Track vulnerability management metrics and remediation status, and follow up with system owners on overdue items
• Help coordinate penetration testing engagements, from scoping and scheduling through findings tracking and remediation follow-up

GRC Operations and Tooling

• Serve as an administrator for our GRC platform, including users, workflows, integrations, and reporting
• Identify opportunities to streamline processes and automate repetitive GRC work
• Help maintain policies, standards, and supporting documentation

What you'll bring

• Experience in cybersecurity, GRC, IT audit, or a related field (typically 2-4 years)
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, or NIST
• Familiarity with risk assessment concepts and the risk management lifecycle
• Strong organization and follow-through, with the ability to juggle many workstreams and deadlines at once
• Clear written and verbal communication, and comfort working with technical and non-technical stakeholders
• A collaborative, curious mindset and a genuine desire to learn and take on new challenges
• Hands-on experience with a GRC platform (e.g., Vanta, Drata, OneTrust, ServiceNow GRC, or similar)
• Experience supporting an audit (SOC 2, ISO 27001, or similar)
• Exposure to any of: vulnerability management, third-party risk, BC/DR, secure development practices, or penetration test coordination
• Scripting or automation skills (e.g., Python, SQL, or workflow tools) to improve GRC processes
• A relevant certification or one in progress (e.g., Security+, CISA, CISM, CISSP)

What you'll get

• Generous performance-based bonus plans to all eligible employees-we share in our success as one team.
• Rich medical, dental, and vision coverage.
• Generous retirement contributions with 100% immediate vesting (regardless of whether you contribute).
• Quarterly all-company wellness days where everyone takes a pause together.
• Country-specific holidays plus a day off for your birthday.
• One-time home office stipend.
• Annual professional development budget.
• Quarterly well-being stipend.
• Considerable paid parental leave.
• Employee referral bonus program.
• Other benefits (life/AD&D, disability, EAP, etc.-varies by country).

Commitment to diversity, equity, inclusion, and belonging

• Group: C
• #LI-REMOTE
• Req ID: R3197
• Hiring Ranges: US Tier 1 Locations $137,000—$183,000 USD
• US Tier 2 Locations $126,000—$168,000 USD
• US Tier 3 Locations $116,000—$155,000 USD