GRC Engineer

📋 Description

• Partner cross-functionally to design and maintain compliance programs (SOC 2, PCI-DSS).
• Own and maintain the compliance platform (Drata), including controls and evidence.
• Manage control documentation, policies, procedures, and artifacts across frameworks.
• Perform risk assessments, vendor security reviews, and control gap analyses; track remediation.
• Build and maintain vendor risk management processes, onboarding, reviews, and risk scoring.
• Partner with Finance and Legal to implement structured vendor and customer risk profiling.

🎯 Requirements

• 3–5+ years of IT Audit, Governance, Risk & Compliance, and/or Information Security.
• Direct SOC 2; PCI-DSS experience strongly preferred.
• Comfortable working directly with auditors, managing audit timelines, and evidence collection.
• Strong understanding of AWS, Okta, and SaaS environments.
• Able to explain data flows, APIs, and infrastructure controls to technical and non-technical audiences.
• Experience with GRC platforms or compliance automation tooling is a plus.