Want to know if this job is worth applying to?
United States
Hybrid
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a GRC Controls Automation Engineer based in the United States.
This role offers an opportunity to strengthen enterprise security and compliance by embedding automated controls directly into software development and cloud infrastructure workflows. You will bridge regulatory requirements, technical architecture, and engineering practices to build scalable governance, risk, and compliance processes. Working across security, engineering, product, and business teams, you will help modernize existing controls, improve operational efficiency, and support secure product development. You will also provide technical guidance on new features and infrastructure changes while helping teams maintain compliance across multiple regulatory frameworks. This is a cross-functional role in a fast-paced environment where strong communication, initiative, and a practical approach to automation are essential. The position follows a hybrid work model, with employees expected to work from their assigned office at least three days per week.
Design, develop, implement, and automate security and compliance controls, embedding requirements into software development lifecycle (SDLC) processes.
Improve existing governance and compliance processes through standardization, automation, and scalable solutions.
Advise technical teams on compliance implications of new product features, infrastructure changes, and deviations from established controls.
Contribute to cloud and application security strategy, planning, and execution.
Assess the organization's security and compliance posture, identify gaps, evaluate emerging trends, and recommend improvements.
Support the secure introduction of products and services into production environments by providing compliance and risk guidance.
Work across regulatory and assurance frameworks, including ISO, PCI, NIST, and AICPA SOC standards.
Maintain accurate process documentation and supporting evidence to facilitate internal and external audits.
Communicate control deficiencies to management and coordinate cross-functional remediation activities.
Monitor compliance issues, track corrective actions, and follow up to ensure control gaps are resolved.
Build trusted relationships with internal teams and external stakeholders, providing clear guidance and ongoing education.
At least 5 years of professional experience in GRC, information security, or a related function within a SaaS company.
Strong understanding of global security and compliance frameworks, including NIST SP 800-53, PCI, ISO 27000-series standards, and SOC 2.
Familiarity with Google Cloud Platform (GCP), cloud computing environments, AI architectures, data governance, and model validation.
Bachelor's degree in Business, Management Information Systems, or a related field, or equivalent professional experience.
Ability to translate regulatory and compliance requirements into practical technical controls and automation solutions.
Strong written, verbal, and presentation skills, with the ability to communicate effectively across technical and non-technical teams.
Excellent organizational skills, adaptability, and the ability to manage priorities in a fast-moving environment.
Proactive, solutions-oriented approach, with strong integrity, accountability, and willingness to take ownership beyond defined responsibilities.
Preferred: Professional certifications such as CISSP, CCSK, CISM, or other relevant security and compliance credentials.
Base salary: $115,500–$145,000 USD, depending on skills, experience, and work location.
Equity eligibility.
Employee benefits are included as part of the compensation package; specific healthcare, retirement, and leave details are not provided in the source description.
Hybrid working arrangement, with at least three days per week in the assigned office.
Opportunity to contribute to AI-enabled enterprise technology and help advance scalable security and compliance practices.
