Security GRC Engineer Compliance And Operations

Arbisoft; Lahore; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

Arbisoft is seeking a Security GRC Engineer with 3–5 years of experience to drive continuous compliance automation and risk-based security improvements across cloud and on-premises environments.

You will architect and implement evidence pipelines for ISMS, conduct risk modeling, and ensure security alignment with ISO, SOC, and NIST standards. Strong SIEM expertise and Gulf compliance exposure are valued.

Qualifications

• Education: BS in Computer Science, Software Engineering, or Cybersecurity.
• Certifications: ISO 27001 Lead Implementer or Auditor.
• Compliance: Experience with SOC 2, ISO 27001, ISO 27701.
• SIEM: Customizing SIEM logic (Wazuh, ELK, QRadar, Panther).
• IR: 2+ years in incident response environments.
• Communication: Translate complex requirements for DevOps/Prod teams.
• Security awareness: Conduct security awareness and training sessions.
• Automation: Automate GRC workflows, including AI approaches.
• Certs: Security+, CHFI, CEH or SOC-related certs.

Responsibilities

• Automate continuous compliance by building evidence-collection pipelines for ISMS (ISO 27001, SOC 2).
• Lead technical risk assessments and threat modeling; track mitigations in a backlog.
• Audit cloud environments (AWS/GCP/Azure) and apps for ISO, SOC, and NIST alignment.
• Review security architecture to ensure design aligns with Security by Design and MD policy.
• Hardening operations using post-incident insights to refine policies and controls.
• Oversee MDM strategy and remediation of vulnerabilities across devices.
• Implement static code analysis and secure, encrypted note-sharing workflows.
• Oversee data privacy controls and regulatory compliance (Gulf-related).

Skills

SIEM mastery

Incident response

Automation in GRC

Security awareness

Cloud security

Education

BS in Computer Science / Software Engineering / Cybersecurity

Tools

Wazuh

ELK

QRadar

Panther

Job description

Job Description

We are seeking a Security GRC Engineer with 3-5 years of experience who is as comfortable auditing a cloud environment as they are tuning a SIEM alert. You will be the primary architect of our integrated security framework, ensuring that our security operations directly satisfy our regulatory obligations (ISO/SOC 2). Your goal is to move us away from manual "point-in-time" audits toward Continuous Compliance through automation and engineering.

Core Responsibilities

• Continuous Compliance Automation: Maintain and evolve our ISMS (ISO 27001 and SOC 2) by building automated evidence-collection pipelines. Candidates possessing relevant Gulf compliance and GRC experience have an added advantage.
• Technical Risk Assessments: Lead technical risk assessments and threat modeling sessions for clients. You won't just list risks; you will work with engineers to design technical mitigations and track them via a risk-register-as-backlog.
• Cloud & Infrastructure Audit: Perform deep-dive technical audits of our cloud environments (AWS/GCP/Azure) and enterprise applications to ensure alignment with ISO, SOC and NIST standards.
• Security Architecture Review: Act as a consultant for internal engineering teams, ensuring new features and infrastructure deployments meet "Security by Design" principles and MDM policy requirements.
• Operational Hardening: Use insights from incident post-mortems and "Blue Team" operations to update security policies and technical controls.
• Vulnerability & MDM Management: Orchestrate our Mobile Device Management (MDM) strategy to ensure endpoint compliance and oversee the remediation of detected vulnerabilities across the fleet.
• Application Security: Implement static code analysis processes and establish secure, encrypted note-sharing workflows to safeguard sensitive operational credentials and communications.
• Privacy & Data Protection Compliance: Oversee data privacy frameworks and controls in compliance. Candidates possessing relevant Gulf privacy compliance have an added advantage.

Technical Qualifications

Required Expertise:

• Education: BS in Computer Science, Software Engineering, or Cybersecurity.
• Certifications: ISO 27001 Lead Implementer or Auditor.
• Compliance Frameworks: Hands-on experience scaling SOC 2, ISO 27001, and ISO 27701 in a modern tech stack.
• SIEM Mastery: Extensive experience customizing SIEM logic (e.g., Wazuh, ELK, QRadar, Panther) to reduce false positives and increase visibility.
• Incident Response: 2+ years of experience in high-pressure IR environments.
• Communication: Ability to translate complex compliance requirements into "Engineer-speak" for DevOps and Product teams.
• Security Awareness: Experience conducting security awareness and training sessions for candidates and onboarding staff.
• Automation: Proficiency in automation of GRC workflows using AI.
• Certifications: Security+, CHFI, CEH, or any SOC-related certification.

Technical "Nice-to-Haves"

• Regulatory Exposure:
• Must Have: GDPR, NIST 800-53, ISO 27701, PDPL
• Good to Have: HIPAA, PCI DSS, FERPA, NCA, NIA, SAMA

AI Risk Management

Hands-on experience assessing AI-related threats and applying AI management standards such as ISO 42001.

Defensive Tech

Good to have with Next-Gen tools (EDR, CSPM, and Zero Trust architectures).

Certifications

CISA, CISM, CISSP