Security Engineer, GRC

What you'll do

• Build a version-controlled source of truth and live pipelines for controls, policies, framework mappings, and evidence; automate continuous control monitoring and detection.
• Develop dashboards and SQL reporting for risk signals, conduct risk assessments, and automate recurring GRC operational work.
• Embed compliance checks and AI-assisted workflows into engineering processes and advance machine-readable continuous compliance.

What they ask for

• Strong Python and SQL, API/webhook integration experience, and ownership of an internal tool or service end to end.
• Hands-on AWS and cloud-native security controls experience, including querying cloud, GitHub, and SaaS logs; dashboarding/data-visualization proficiency.
• Experience building continuous controls monitoring and modeling controls and framework mappings as structured, version-controlled data.
• Hands-on Terraform and policy-as-code (OPA/Rego, Sentinel), CI/CD compliance checks, working knowledge of SOC 2, ISO 27001/27701, and NIST CSF/800-53, and demonstrated ability to build and scale agentic/AI-assisted workflows.

Nice to have

• Direct experience with FedRAMP, FedRAMP 20x, or other public-sector/continuous-compliance authorizations; experience with compliance automation platforms.
• Exposure to incident response and triage, or experience in fintech/financial services; a related degree is also listed as nice to have.

Pay

$156K – $213.6K (base salary; currency not stated)

Tools

Python, SQL, AWS, GitHub, Terraform, OPA/Rego, Sentinel, Claude

AI focus

Build and scale agentic/AI-assisted workflows, embed compliance checks into CI/CD, and prototype self-healing policies reconciled against live infrastructure.