Associate GRC Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Associate GRC Engineer based in the United States.

As an Associate GRC Engineer, you will help build and maintain automated governance, risk, and compliance (GRC) programs that enable organizations to manage security and compliance continuously. You will contribute to developing automated control checks, evidence collection workflows, and policy-as-code solutions that strengthen security and simplify audit preparation. Working closely with senior engineers, you will collaborate with client security, platform, and audit teams across multiple industries and compliance environments. Your work will support frameworks such as SOC 2, ISO/IEC 27001, NIST SP 800-53, FedRAMP, and CMMC. This role combines cybersecurity, cloud technologies, scripting, and automation to make compliance more efficient, reliable, and scalable. You will also help identify configuration gaps, investigate control failures, and ensure compliance evidence remains accurate and up to date. The position offers an opportunity to develop your technical expertise while contributing to impactful security and compliance initiatives in a remote environment.

Accountabilities

Build and maintain automated evidence collection workflows by integrating cloud, identity management, human resources, and ticketing systems through their APIs.
Develop, test, and maintain automated control checks and policy-as-code rules using tools such as Open Policy Agent or HashiCorp Sentinel, under the guidance of senior engineers.
Map security controls to relevant regulatory and compliance framework requirements, ensuring the control library remains accurate and properly maintained in version control.
Investigate failed automated checks, identify configuration drift, and coordinate with the appropriate stakeholders to ensure issues are resolved.
Generate and organize system-based compliance evidence to support external audits, internal assessments, and customer security reviews.
Collaborate with senior GRC engineers and cross-functional client teams to continuously improve compliance automation processes and security controls.
Requirements
At least 2 years of professional experience in governance, risk, and compliance (GRC), IT auditing, security operations, cloud engineering, or a related field.
Practical scripting experience in Python or a similar programming language, with regular use of Git for version control.
Working knowledge of at least one recognized security or compliance framework, such as SOC 2, ISO/IEC 27001, or NIST SP 800-53.
Familiarity with at least one major cloud platform: AWS, Microsoft Azure, or Google Cloud Platform.
Understanding of security controls, compliance requirements, and evidence management processes.
Strong written communication skills, with the ability to document technical findings and communicate effectively with technical and non-technical stakeholders.
Ability to collaborate within a team, investigate technical issues, and work under the guidance of senior engineers.
Nice to have: Experience with Terraform or other infrastructure-as-code tools, familiarity with modern compliance automation platforms, and knowledge of SQL.
Must be authorized to work in the United States.
Benefits
Fully remote position within the United States.
Full-time employment opportunity.
Opportunity to work on diverse cybersecurity and compliance projects across multiple frameworks and industries.
Hands-on experience with cloud security, policy-as-code, automation, and modern GRC technologies.
Opportunity to learn from and collaborate with experienced GRC and security engineering professionals.
Professional development through exposure to recognized compliance frameworks, cloud environments, and automation tools.
Equal opportunity work environment.