Staff Security Governance Engineer, Policies & Standards

What you'll do

• Draft, maintain, publish, review, and retire security policies and standards; manage exceptions and attestations.
• Align policies with regulations and frameworks, assess adherence, report KPIs, and support audits and remediation.
• Implement automation and AI-assisted governance workflows and lead cross-functional programs across Security, Product, Legal, and Engineering.

What they ask for

• 10+ years in security governance, GRC, or IT risk, including hands-on ownership of a policy and standards lifecycle with measurable outcomes.
• Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, and experience creating and maintaining an enterprise ISMS.
• Understanding of cloud, SaaS, and DevSecOps practices, with the ability to write policies engineers will follow.
• Demonstrated use of automation or AI to reduce manual GRC work; strong communication and cross-functional collaboration skills.

Nice to have

• Hands-on involvement in ISO 27001 certification or recertification.
• Certifications such as CISSP, CISM, CISA, or similar.

Pay

$168,000 — $238,000 USD (base salary)

Tools

SOC 2, ISO 27001, ISO 42001, FedRAMP, NIST CSF, EU AI Act, NIST AI RMF, PCI-DSS

AI focus

Monitor AI regulations and use automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessments.