AI-Driven Risk Automation Engineer

Remote; San Francisco (CA); Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical, dental & vision insurance

401(k) with company match

Paid time off & holidays

Parental and family leave

Cell phone stipend

Job summary

Lumin Digital is seeking a Risk Automation Engineer to redesign risk management in a cloud-native, IaC environment. You will design, build, and operate automated pipelines for risk and vendor lifecycle processes, aiming for near real-time risk visibility and self-service workflows across the enterprise.

You will lead the development of agentic AI pipelines, integrate GRC platforms and cloud APIs, and enforce security-first practices, with the broader Risk and Compliance teams benefiting from

Qualifications

• 5+ years of hands-on software engineering, DevOps, or security automation in production environments.
• 2+ years working in or directly supporting risk management functions or GRC operations.
• Demonstrated experience building and shipping automation pipelines using Python, Go, Bash, or similar languages, with infrastructure-as-code tools such as Terraform.
• Track record of using AI/LLM tools (e.g., Claude Code, GitHub Copilot, or equivalent) to accelerate engineering output and build agentic or semi-autonomous workflows.
• Experience with risk registers and GRC platforms (e.g., Archer, ServiceNow, TrustCloud, Vanta, Drata, Hyperproof) and the ability to integrate them programmatically into automated workflows.

Responsibilities

• Architect and build lights-off automation pipelines that orchestrate the full risk assessment lifecycle—from intake and scoping through evidence collection, control testing, findings generation, and remediation tracking—using AI-driven agentic workflows and tools such as Claude Code.
• Design and implement automated vendor risk lifecycle management, including onboarding questionnaires, periodic reassessment triggers, continuous monitoring integrations, and contract-driven offboarding workflows that require zero manual coordination for routine vendor tiers.
• Build and maintain near-real-time risk posture dashboards and reporting pipelines that programmatically aggregate data from cloud infrastructure, security tooling, vulnerability scanners, and GRC platforms to give leadership continuous visibility into the organization’s evolving risk landscape.
• Develop secure agentic AI pipelines that autonomously triage, classify, and route risk-related tasks—escalating to human reviewers only when decisions exceed defined confidence thresholds or policy boundaries.
• Engineer integrations between GRC platforms, cloud and vendor provider APIs, CI/CD pipelines, and internal systems to enable continuous control monitoring and evidence collection that replaces periodic, manual audit preparation.
• Eliminate procedural ambiguity by codifying risk management processes into self-service, event-driven workflows so that stakeholders across the enterprise never need to ask how to initiate or proceed through a risk or vendor process.
• Apply security-first engineering practices to all automation, including secrets management, least-privilege access, audit logging, input validation, and guardrails on AI agent behavior to ensure automated pipelines operate within defined trust boundaries.
• Serve as an internal force multiplier by introducing and evangelizing AI-assisted engineering practices, including prompt engineering, agentic tool use, and LLM-powered code generation, to uplevel the capabilities of the broader Risk and Compliance teams.
• Perform other duties as assigned.

Job description

Lumin Digital is seeking a Risk Automation Engineer to redesign risk management in a cloud-native, IaC environment. You will design, build, and operate automated pipelines for risk and vendor lifecycle processes, aiming for near real-time risk visibility and self-service workflows across the enterprise.

You will lead the development of agentic AI pipelines, integrate GRC platforms and cloud APIs, and enforce security-first practices, with the broader Risk and Compliance teams benefiting from