Associate GRC Engineer

Accountabilities: Build and maintain automated evidence collection workflows by integrating cloud, identity management, human resources, and ticketing systems through their APIs. Develop, test, and maintain automated control checks and policy-as-code rules using tools such as Open Policy Agent or HashiCorp Sentinel, under the guidance of senior engineers. Map security controls to relevant regulatory and compliance framework requirements, ensuring the control library remains accurate and properly maintained in version control. Investigate failed automated checks, identify configuration drift, and coordinate with the appropriate stakeholders to ensure issues are resolved. Generate and organize system-based compliance evidence to support external audits, internal assessments, and customer security reviews. Collaborate with senior GRC engineers and cross-functional client teams to continuously improve compliance automation processes and security controls. Requirements At least 2 years of professional experience in governance, risk, and compliance (GRC), IT auditing, security operations, cloud engineering, or a related field. Practical scripting experience in Python or a similar programming language, with regular use of Git for version control. Working knowledge of at least one recognized security or compliance framework, such as SOC 2, ISO/IEC 27001, or NIST SP 800-53. Familiarity with at least one major cloud platform: AWS, Microsoft Azure, or Google Cloud Platform. Understanding of security controls, compliance requirements, and evidence management processes. Strong written communication skills, with the ability to document technical findings and communicate effectively with technical and non-technical stakeholders. Ability to collaborate within a team, investigate technical issues, and work under the guidance of senior engineers. Nice to have: Experience with Terraform or other infrastructure-as-code tools, familiarity with modern compliance automation platforms, and knowledge of SQL. Must be authorized to work in the United States. Benefits Fully remote position within the United States. Full-time employment opportunity. Opportunity to work on diverse cybersecurity and compliance projects across multiple frameworks and industries. Hands-on experience with cloud security, policy-as-code, automation, and modern GRC technologies. Opportunity to learn from and collaborate with experienced GRC and security engineering professionals. Professional development through exposure to recognized compliance frameworks, cloud environments, and automation tools. Equal opportunity work environment.