Senior Security Engineer GRC Engineering

<h3>Accountabilities</h3><li>Own the end-to-end continuous control monitoring program, integrating identity providers, cloud platforms, code repositories, endpoint management, ticketing systems, and other relevant data sources.</li><li>Build monitoring and alerting workflows that identify degraded controls, route issues to accountable owners, and verify remediation.</li><li>Develop and maintain a centralized common controls framework using ISO 27001 and SOC 2 as foundational frameworks, while mapping additional regulatory and compliance requirements against it.</li><li>Create an evidence management layer that captures, timestamps, indexes, and reuses audit evidence across multiple frameworks.</li><li>Design the compliance platform so that its own activity, controls, and evidence remain auditable and aligned with the standards it measures.</li><li>Develop control validations as code, producing outputs that are actionable for engineers and suitable for audit and assessment purposes.</li><li>Collaborate with infrastructure security teams on policy-as-code initiatives and ensure enforced policies generate the evidence required by applicable frameworks.</li><li>Identify appropriate applications for AI and agentic workflows in control mapping, evidence classification, validation, and other compliance activities while maintaining appropriate human oversight.</li><li>Set the strategic direction of the compliance engineering program, including framework priorities, automation opportunities, and allocation of engineering resources.</li><li>Develop and monitor program metrics covering control health, framework coverage, remediation velocity, and other indicators used by leadership.</li><li>Integrate cyber risk management into the compliance platform, connecting risk registers, exceptions, control telemetry, ownership, and expiration tracking.</li><li>Maintain accurate asset prioritization to support risk decisions, control coverage, remediation sequencing, and compliance activities.</li><li>Provide technical leadership during audits by explaining how controls are implemented, monitored, and evidenced to assessors and other stakeholders.</li><li>Work closely with compliance analysts and other security teams to automate workflows while ensuring areas requiring human judgment remain appropriately governed.</li><h2>Requirements</h2><li>6+ years of experience spanning compliance program leadership, security engineering, or compliance engineering, with meaningful experience across both governance/framework work and technical implementation.</li><li>Demonstrated experience leading a major compliance framework through assessment, readiness, certification, or authorization, such as FedRAMP or a comparable framework,<strong>or</strong>significant ownership of an end-to-end GRC engineering program involving continuous monitoring and evidence automation.</li><li>Strong experience designing and mapping controls across multiple frameworks, with the ability to establish a practical and defensible common controls structure.</li><li>Recent hands-on engineering experience using<strong>Python and APIs</strong>for integrations and automation.</li><li>Recent experience building or implementing AI-assisted compliance or security workflows, ideally within the last six months, with a clear understanding of how to validate automated outputs.</li><li>Strong knowledge of<strong>ISO 27001 and SOC 2</strong>, with familiarity with FedRAMP 20x, NIS2, DORA, and PCI DSS.</li><li>Understanding of policy-as-code concepts and the role of automated enforcement within security and compliance programs.</li><li>Sufficient Azure and AWS knowledge to identify where relevant compliance evidence is generated and how cloud controls can be monitored.</li><li>Experience with compliance automation or GRC platforms and the judgment to determine when to configure existing capabilities versus build custom solutions.</li><li>Experience managing audit calendars, assessor relationships, evidence requests, and technical audit discussions.</li><li>Strong understanding of risk management, exception handling, control ownership, remediation tracking, and asset prioritization.</li><li>Ability to communicate technical compliance concepts clearly to both engineers and auditors.</li><li>Strong analytical, problem-solving, and organizational skills, with the ability to manage competing priorities and make sound risk-based decisions.</li><li>Experience working with hosted services and customer-deployed software is advantageous.</li><li>Experience on the assessor side, IRAP or other international regulatory regimes, or previous experience as a software/platform engineer is a plus.</li><h2>Benefits</h2><li>Remote working opportunity based in India.</li><li>Senior individual contributor role with significant ownership of the GRC engineering strategy and roadmap.</li><li>Opportunity to build and modernize compliance engineering capabilities from the ground up.</li><li>Exposure to cloud security, continuous control monitoring, policy-as-code, AI-assisted compliance, and automated evidence management.</li><li>Direct opportunity to influence how security and compliance programs support audits, certifications, customer requirements, and market expansion.</li><li>Globally distributed and collaborative working environment.</li><li>Opportunities for professional development, technical growth, and expanded security leadership responsibilities.</li><li>Employee-focused health and wellbeing programs.</li><li>Inclusive and equal-opportunity workplace committed to a respectful and supportive environment.</li>