Whatnot
Security Engineer (GRC)
$175K–$230K
San Francisco, CA +3 · Full-time · Posted Aug 18, 2026
- Location
- San Francisco, CA
New York, NY
Los Angeles, CA
Seattle, WA - Experience
- Minimum 5+ years of relevant experience in security governance, risk, and compliance.
- Education
- Bachelor’s degree in Computer Science, Information Security, or a related field.
About the job
Leads security governance, risk, and compliance work, including secure configuration reviews, external audits, security requirements, and risk management.
What you'll do
- Review secure configurations, develop security requirements for partner teams, and drive implementation.
- Prepare for and run external security audits.
- Lead the security risk management program and help shape the GRC team’s strategy.
What they ask for
- Bachelor’s degree in Computer Science, Information Security, or a related field.
- Deep knowledge of security best practices and standards, including ISO 27001, SOC2, PCI, and GDPR/CCPA.
- Experience at a Big 4 or similar reputable audit firm, including support for complex third-party audits in cloud-centric environments.
- Excellent written communication and experience creating and running a security risk management program.
Nice to have
- Relevant experience in a tech startup environment.
Pay
$175K - $230K (base salary)
Tools
Okta, Terraform, AWS, Lumos, Cloudflare, Github
Model-written summary · the original posting is authoritative