Security GRC Engineer (Compliance & Operations)

Arbisoft; Lahore; On-site; PKR 2,500,000 - 4,500,000; Full time

Benefits offered by this job

Restaurant on-site

Job summary

Arbisoft in Pakistan is seeking a Security GRC Engineer with 3–5 years' experience to design and automate a unified security program. The role focuses on continuous compliance, cloud audits, and security-by-design across ISO 27001, SOC 2, and NIST standards.

You will lead audits, build evidence pipelines, tune SIEMs, oversee incident response, and drive secure DevOps with AI-enabled automation. This is a hands-on, cross-functional role that collaborates with engineering, product, and security

Qualifications

• BS in Computer Science, Software Engineering, or Cybersecurity.
• ISO 27001 Lead Implementer or Auditor certification preferred.
• Hands-on experience scaling SOC 2, ISO 27001, and ISO 27701 in modern tech stacks.
• SIEM mastery with Wazuh, ELK, QRadar, or Panther to reduce false positives.

Responsibilities

• Maintain and evolve ISMS (ISO 27001 and SOC 2) with automated evidence pipelines.
• Lead technical risk assessments and threat modeling sessions.
• Perform cloud and enterprise application audits against ISO, SOC, and NIST standards.
• Advise engineering teams on Security by Design and MDM policy requirements.
• Update security policies using incident post-mortems and blue-team insights.
• Oversee MDM strategy and remediation of reported vulnerabilities.
• Implement static code analysis processes and secure credential handling.

Skills

GRC automation

ISO 27001

SOC 2

Threat modeling

Incident response

Security awareness

Communication

AI automation

Education

BS in CS/SE/Cybersecurity

Tools

Wazuh

ELK

QRadar

Panther

Job description

Job Description

We are seeking a Security GRC Engineer with 3-5 years of experience who is as comfortable auditing a cloud environment as they are tuning a SIEM alert. You will be the primary architect of our integrated security framework, ensuring that our security operations directly satisfy our regulatory obligations (ISO/SOC 2). Your goal is to move us away from manual "point-in-time" audits toward Continuous Compliance through automation and engineering.

Core Responsibilities

• Continuous Compliance Automation: Maintain and evolve our ISMS (ISO 27001 and SOC 2) by building automated evidence-collection pipelines. Candidates possessing relevant Gulf compliance and GRC experience have an added advantage.
• Technical Risk Assessments: Lead technical risk assessments and threat modeling sessions for clients. You won't just list risks; you will work with engineers to design technical mitigations and track them via a risk-register-as-backlog.
• Cloud & Infrastructure Audit: Perform deep-dive technical audits of our cloud environments (AWS/GCP/Azure) and enterprise applications to ensure alignment with ISO, SOC and NIST standards.
• Security Architecture Review: Act as a consultant for internal engineering teams, ensuring new features and infrastructure deployments meet "Security by Design" principles and MDM policy requirements.
• Operational Hardening: Use insights from incident post-mortems and "Blue Team" operations to update security policies and technical controls.
• Vulnerability & MDM Management: Orchestrate our Mobile Device Management (MDM) strategy to ensure endpoint compliance and oversee the remediation of detected vulnerabilities across the fleet.
• Application Security: Implement static code analysis processes and establish secure, encrypted note-sharing workflows to safeguard sensitive operational credentials and communications.
• Privacy & Data Protection Compliance: Oversee data privacy frameworks and controls in compliance. Candidates possessing relevant Gulf privacy compliance have an added advantage.

Technical Qualifications

Required Expertise

• Education: BS in Computer Science, Software Engineering, or Cybersecurity.
• Certifications: ISO 27001 Lead Implementer or Auditor.
• Compliance Frameworks: Hands-on experience scaling SOC 2, ISO 27001, and ISO 27701 in a modern tech stack.
• SIEM Mastery: Extensive experience customizing SIEM logic (e.g., Wazuh, ELK, QRadar, Panther) to reduce false positives and increase visibility.
• Incident Response: 2+ years of experience in high-pressure IR environments.
• Communication: Ability to translate complex compliance requirements into "Engineer-speak" for DevOps and Product teams.
• Security Awareness: Experience conducting security awareness and training sessions for candidates and onboarding staff.
• Automation: Proficiency in automation of GRC workflows using AI.
• Certifications: Security+, CHFI, CEH, or any SOC-related certification.

Technical "Nice-to-Haves"

• Regulatory Exposure: Must Have: GDPR, NIST 800-53, ISO 27701, PDPL. Good to Have: HIPAA, PCI DSS, FERPA, NCA, NIA, SAMA.
• AI Risk Management: Hands-on experience assessing AI-related threats and applying AI management standards such as ISO 42001.
• Defensive Tech: Good to have with Next-Gen tools (EDR, CSPM, and Zero Trust architectures).
• Certifications: CISA, CISM, CISSP.

Be one of the first to apply

How strong is your profile for this job?

Get personalized insights on where you stand and how to improve.