GRC Engineer I.

Accountabilities

• Support the implementation and ongoing maintenance of client security compliance programs aligned with SOC 2, ISO 27001, NIST CSF, and relevant regulatory standards.

• Create, maintain, and update security policies, standard operating procedures, and control evidence to support audits and compliance assessments.

• Work with technical and operational teams to identify, evaluate, track, and remediate cybersecurity risks and control gaps.

• Coordinate project deliverables, compliance milestones, evidence collection, and task execution across multiple client engagements, with guidance from senior team members.

• Serve as a direct point of contact for client stakeholders through email, chat, and video calls, gathering evidence, clarifying control requirements, and communicating progress.

• Conduct structured control testing and compliance readiness reviews to assess alignment with applicable frameworks and requirements.

• Collaborate with internal IT, security, and operations teams to implement corrective action plans and strengthen clients’ security posture.

• Contribute to the continuous improvement and scaling of service delivery by updating templates, playbooks, and standard operating procedures.

• Manage assigned client accounts and coordinate engagement activities while maintaining a high standard of service, responsiveness, and professionalism.

Requirements:

• Hands-on experience supporting or delivering cybersecurity GRC initiatives within technology-focused environments.

• Practical experience with at least one of the following frameworks: SOC 2, ISO 27001, or NIST CSF.

• Familiarity with developing, implementing, and maintaining cybersecurity policies, procedures, and control requirements.

• Demonstrated ability to manage multiple projects or client engagements simultaneously while maintaining organization, quality, and momentum.

• Strong written and verbal English communication skills, with the ability to engage professionally with U.S.-based clients and technical or executive stakeholders.

• A client-focused approach, sound judgment, and the ability to handle questions, challenges, and escalations with urgency and composure.

• Ability to adapt to a fast-paced startup environment and shifting priorities.

• Reliable high-speed internet access and a quiet, professional home office suitable for confidential discussions and virtual collaboration.

• Availability to work a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time.

• Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities.

• Practical experience with compliance automation platforms such as Vanta or similar GRC tools is an advantage.

• Familiarity with additional frameworks such as GDPR, HIPAA, or PCI DSS is beneficial.

• Relevant certifications, such as ISO 27001 Lead Implementer, CISA, or CompTIA Security+, are advantageous.

Benefits:

• Competitive base salary, with regular performance reviews and merit-based appraisal opportunities.

• Potential bonus opportunities linked to performance.

• Mentorship, training, and career development opportunities.

• Reimbursement for approved role-related training and certification courses, subject to applicable conditions.

• Opportunities for career growth within an expanding organization.

• Remote-first working environment with flexibility to work from anywhere while collaborating with a global team.