GRC Engineer I

VulnU; São Paulo; Hybrid; BRL 180,000 - 300,000; Full time

Benefits offered by this job

Equity

Hybrid work environment

Job summary

Brex is seeking a GRC Engineer in São Paulo to lead cross-functional governance, risk, and compliance initiatives. You will drive security controls, support audits, and design automations that improve evidence collection and reporting across teams.

You will work within the Trust organization, collaborating with security, product, and operations to mature Brex's security posture and compliance programs while enabling scalable growth in a hybrid, in-office setting with some remote flexibility.

Qualifications

• Proven track record of cross-functional collaboration across teams.
• Experience with security compliance frameworks and audits (SOC 2, PCI DSS, NIST, ISO 27001).
• Experience leveraging AI to build automations to reduce manual workload.
• Ability to conduct third party risk due diligence and vendor reviews.
• Strong written and verbal communication with precise articulation of complex concepts.

Responsibilities

• Work under guidance of GRC experts on cross-functional programs.
• Enhance GRC Engineering program, build automations for evidence collection and dashboards.
• Conduct third party risk due diligence for vendor relationships.
• Maintain risk register and prepare risk reports.
• Review policies and assist with audit readiness and evidence collection.

Skills

Cross-functional collab

Security frameworks

AI automation

Vendor risk assessment

Clear communication

Tools

Automation tools

GRC tooling

Job description

# GRC Engineer IBrex · brex.comCategory: GRC & ComplianceLocation: São Paulo, São Paulo, Brazil## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* EquityWhy join usBrex is the intelligent finance platform that enables companies to spend smarter and move faster in more than 200 markets. By combining global corporate cards and banking with intuitive spend management, bill pay, and travel software, Brex enables founders and finance teams to accelerate operations, gain real-time visibility, and control spend effortlessly. Brex’s AI-native automation and world-class service eliminate manual expense and accounting tasks for customers so they can focus on what matters most. Tens of thousands of the world's best companies run on Brex, including DoorDash, Coinbase, Robinhood, Zoom, Plaid, Reddit, and SeatGeek.Working at Brex allows you to push your limits, challenge the status quo, and collaborate with some of the brightest minds in the industry. We’re committed to building a diverse team and inclusive culture and believe your potential should only be limited by how big you can dream. We make this a reality by empowering you with the tools, resources, and support you need to grow your career.Engineering at BrexEngineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It's an environment where engineering is a craft, and builders become leaders.What you’ll doBuilding world-class financial services requires world-class security. As a GRC Engineer on the Trust team, you will work on high-impact cross-organization governance, risk, and compliance initiatives. You’d advocate for security across the company and scale Trust efforts while executing hands-on yourself.GRC’s mission is to instill trust in Brex from our customers, regulators, partners, and workforce in order to enable the company’s continued growth by maturing our security posture, maintaining compliance, optimizing security practices, and mitigating enterprise risk. We serve as the business side of Trust, and of Compliance as the what, Governance as the how, and Risk as the why, of Trust.Where you'll workThis role will be based in our São Paulo office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of 3 days per week in the office - Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work.ResponsibilitiesThe GRC team handles a wide range of cross-functional activities from security compliance certifications and audits to risk management, vendor reviews, inbound due diligence, security education, access control, policy and procedures, and many more. Each of these ongoing parallel activities entails interpreting and setting requirements, assessing the effectiveness of security controls, risk-based decision making, cross-functional collaboration and communication, and staying up-to-date on security best practices and how changes in the evolving threat landscape need to inform our strategy. We always strive to go above and beyond industry standards in every aspect of GRC while keeping a balance with supporting the business’s goals. GRC is responsible for key programs that allow us to pass our audit requirements and underpin our risk management mandate. Each of these require strategic thinking and operational execution.As a GRC Engineer, you will get hands-on experience in the Trust field by developing your skills across numerous impactful operational tasks, in turn contributing to the strategy and evolving maturity of our Trust posture.ResponsibilitiesWork under the guidance of seasoned GRC experts and gain exposure to a range of cross-functional programs and processes, both technical and business-centric.Enhance our GRC Engineering program, including building automations to improve compliance evidence collection, monitoring, and reporting dashboards.Conduct third party risk due diligence activities, namely identifying and assessing risks associated with existing and new vendor relationships prior to procurement and periodically thereafter, continuously monitoring for any relevant changes to the risk level or engagement scope. Where findings are identified during assessments, you would ensure plans of actions and check-ins are in place.Other Operational GRC TasksRisk Register maintenance and reportingGTM Enablement supportTooling access requestsContractor request reviewsTravel security request reviewsSecurity compliance evidence collectionTriaging of questions and requests for the GRC team (and learning to provide risk advisory over time!)Policy review and revisionRequirementsProven track record of cross-functional collaborationExperience leveraging AI to build automations to reduce manual workloadExperience with security compliance frameworks and audits (e.g. SOC 2, PCI DSS, NIST, ISO 27001)Diligence and attention to detail in both process and content, strong written and verbal communication skills, with a talent for precise and clear articulation of complex conceptsProven track record of cross-functional collaborationAn aptitude for representing the needs of both your team, other stakeholders, and the overall businessAbility to work in a fast-paced environment and address difficult situations in a professional mannerStrong interpersonal skills and comfortable working across various functionsBeing innovative and providing “outside of the box” solutionsPassion for having an owner’s mentality towards responsibilitiesBonus pointsExperience at technology, security, or risk focused companiesFluency with other GRC operational work and security support tasks such as policy revision, audit preparation and evidence collection, process design and improvement, customer/prospect/partner assurance, etc.Experience working in or with startups, especially during periods of growthKnowledge of fundamental security concepts and domains, in order to both assess the vendor’s security practices and also to define and document requirements on how we should safely use their products and/or services to mitigate relevant threats and how the implementation of a vendor may impact the security posture of the current environmentPlease be aware, job-seekers may be at risk of targeting by malicious actors looking for personal data. Brex recruiters will only reach out via LinkedIn or email with a brex.com domain. Any outreach claiming to be from Brex via other sources should be ignored.