GRC Engineer I

Accountabilities: Support the implementation and ongoing maintenance of client security compliance programs aligned with SOC 2, ISO 27001, NIST CSF, and relevant regulatory standards. Create, maintain, and update security policies, standard operating procedures, and control evidence to support audits and compliance assessments. Work with technical and operational teams to identify, evaluate, track, and remediate cybersecurity risks and control gaps. Coordinate project deliverables, compliance milestones, evidence collection, and task execution across multiple client engagements, with guidance from senior team members. Serve as a direct point of contact for client stakeholders through email, chat, and video calls, gathering evidence, clarifying control requirements, and communicating progress. Conduct structured control testing and compliance readiness reviews to assess alignment with applicable frameworks and requirements. Collaborate with internal IT, security, and operations teams to implement corrective action plans and strengthen clients’ security posture. Contribute to the continuous improvement and scaling of service delivery by updating templates, playbooks, and standard operating procedures. Manage assigned client accounts and coordinate engagement activities while maintaining a high standard of service, responsiveness, and professionalism. Requirements: Hands-on experience supporting or delivering cybersecurity GRC initiatives within technology-focused environments. Practical experience with at least one of the following frameworks: SOC 2, ISO 27001, or NIST CSF. Familiarity with developing, implementing, and maintaining cybersecurity policies, procedures, and control requirements. Demonstrated ability to manage multiple projects or client engagements simultaneously while maintaining organization, quality, and momentum. Strong written and verbal English communication skills, with the ability to engage professionally with U.S.-based clients and technical or executive stakeholders. A client-focused approach, sound judgment, and the ability to handle questions, challenges, and escalations with urgency and composure. Ability to adapt to a fast-paced startup environment and shifting priorities. Reliable high-speed internet access and a quiet, professional home office suitable for confidential discussions and virtual collaboration. Availability to work a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time. Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities. Practical experience with compliance automation platforms such as Vanta or similar GRC tools is an advantage. Familiarity with additional frameworks such as GDPR, HIPAA, or PCI DSS is beneficial. Relevant certifications, such as ISO 27001 Lead Implementer, CISA, or CompTIA Security+, are advantageous. Benefits: Competitive base salary, with regular performance reviews and merit-based appraisal opportunities. Potential bonus opportunities linked to performance. Mentorship, training, and career development opportunities. Reimbursement for approved role-related training and certification courses, subject to applicable conditions. Opportunities for career growth within an expanding organization. Remote-first working environment with flexibility to work from anywhere while collaborating with a global team.