Security Engineer, GRC Frameworks & AI Governance

About the job

Responsibilities

• Own and execute security compliance implementation and audits across frameworks like SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act, including control design, mapping, gap assessment, evidence collection, and remediation tracking.
• Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, and continuous evidence pipelines integrated into development and deployment workflows.
• Operate and extend GRC platforms (e.g., Vanta) as the system of record for controls, evidence, and audit readiness, integrating them with cloud, identity, and engineering tooling.
• Partner with engineering and architecture to embed compliance requirements early in design reviews and translate framework obligations into clear technical control narratives.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures that support the company's governance and AI management system posture.
• Identify, assess, and prioritize risks related to AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with a focus on AI system risks.
• Own and cultivate relationships with external auditors, assessors, and regulators, serving as the liaison between auditors and internal teams.
• Champion a culture of security and compliance across the company by educating teams on the purpose of controls.

Requirements

• Bachelor's degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert-level working knowledge of several frameworks including SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001.
• Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, Drata), with a focus on continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and work with engineers on remediation.
• 10+ years of security compliance, GRC engineering, or technology audit-related experience (preferred).
• Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines (preferred).
• Experience in the tech or AI/ML industry, particularly with startups or high-growth product organizations (preferred).
• Working knowledge of HIPAA privacy and security rules (preferred).
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination (preferred).
• Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act) and associated operational risks (preferred).
• Working knowledge in data privacy frameworks (e.g., GDPR, CCPA) in a technology or cloud environment (preferred).