Senior Security GRC Engineer

American Express Global Business Travel; India; On-site; INR 900,000 - 1,500,000; Full time

Job summary

American Express Global Business Travel seeks a Senior Security GRC Engineer to design, build, and scale automation and AI-driven solutions that modernize our governance, risk, and compliance program.

The role sits at the intersection of security engineering and GRC, translating manual, evidence-heavy processes into automated, data-driven workflows, leveraging AI to reduce risk and improve control coverage for the organization.

Qualifications

• Bachelor's degree in computer science, information security, information systems, or a related field.
• 5+ years of experience in security engineering, GRC, or a related field with automation/AI experience.
• Hands-on experience applying AI/ML technologies (including LLMs) to real-world use cases.
• Strong understanding of cybersecurity frameworks (NIST, ISO 27001, SOC 2) and regulatory requirements (GDPR, PCI DSS).
• Experience with GRC platforms such as Onspring, Archer, MetricStream, or similar tools, including configuration or integration work.
• Familiarity with risk assessment methodologies, control frameworks, and audit evidence requirements.

Responsibilities

• Design, build, and maintain automation pipelines for collecting, normalizing, and validating evidence across security and business systems.
• Prototype and deploy AI/LLM-based solutions to accelerate GRC workflows like control testing and policy mapping.
• Integrate GRC tooling with security/IT systems via APIs to enable automated data flows, dashboards, and reporting.
• Develop scripts, bots, and workflow tools to automate recurring GRC tasks like evidence gathering and audit prep.
• Collaborate with Security GRC analysts and program managers to re-engineer manual processes into scalable automation.
• Establish guardrails, testing, and quality controls to ensure AI outputs are accurate, explainable, and compliant.
• Monitor performance, reliability, and risk posture of automation/AI tools within GRC.
• Stay updated on AI, automation, and GRC tech and promote adoption of new tools.
• Collaborate with other AmexGBT teams to align automation with security and compliance goals.

Skills

Security engineering

GRC

Automation

AI/ML

LLMs

APIs

Education

Bachelor's degree in CS/IS/Security or related field

Tools

Onspring

Archer

MetricStream

Job description

Amex GBT's Security GRC team is looking for a talented Senior Security GRC Engineer to design, build, and scale automation and AI-driven solutions that modernize our governance, risk, and compliance program. This role sits at the intersection of security engineering and GRC, translating manual, evidence-heavy processes into automated, data-driven workflows. The ideal candidate combines hands-on engineering skills with a strong understanding of GRC principles, and is excited to apply AI and automation to reduce risk, improve control coverage, and free up the team to focus on higher-value analysis.

What You'll Do

• Design, build, and maintain automation pipelines that continuously collect, normalize, and validate compliance and control evidence across security and business systems.
• Evaluate, prototype, and deploy AI and large language model (LLM)-based solutions to accelerate GRC workflows, including control testing, evidence review, policy mapping, and risk narrative generation.
• Integrate GRC tooling (e.g., Onspring, Archer, MetricStream, or similar platforms) with security and IT systems via APIs to enable automated data flows, dashboards, and reporting.
• Develop and maintain scripts, bots, and workflow tools that automate recurring GRC tasks such as evidence gathering, control monitoring, and audit preparation.
• Partner with Security GRC analysts and program managers to identify manual, repetitive processes and re-engineer them into scalable, automated solutions.
• Establish guardrails, testing, and quality controls to ensure AI-assisted outputs are accurate, explainable, and compliant with regulatory and audit requirements.
• Monitor and report on the performance, reliability, and risk posture of automation and AI tools used within the GRC program.
• Stay current with emerging AI, automation, and GRC technologies, and recommend adoption of new tools and techniques to continuously improve program maturity.
• Collaborate with other AmexGBT teams (security, engineering, data, and business) to align automation initiatives with broader security posture and compliance goals.

What We're Looking For

• Bachelor's degree in computer science, information security, information systems, or a related field (or equivalent experience).
• 5+ years of experience in security engineering, GRC, or a related field, with demonstrated experience building automation or AI-enabled solutions.
• Hands-on experience applying AI or machine learning technologies (including LLMs and generative AI) to real-world business or security use cases.
• Solid understanding of cybersecurity frameworks (NIST, ISO 27001, SOC 2) and regulatory compliance requirements (GDPR, PCI DSS).
• Experience with GRC platforms such as Onspring, Archer, MetricStream, or similar tools, including configuration or integration work.
• Familiarity with risk assessment methodologies, control frameworks, and audit evidence requirements.
• Strong analytical and problem-solving skills, with the ability to translate complex, manual processes into automated solutions.
• Excellent communication and reporting skills, with the ability to present technical solutions and their risk/compliance impact to both technical and non-technical stakeholders.