GRC Automation Engineer — Controls & Compliance

Box; United States; On-site; USD 140,000 - 190,000; Full time

Job summary

Box is seeking a seasoned GRC Controls Automation Engineer to embed compliance into software development. You’ll design, implement, and automate controls across the SDLC, guiding product features and infrastructure changes to improve security posture.

You’ll work with cross-functional teams and stakeholders, driving continuous improvement in a fast-paced, AI‑driven environment. You bring 5+ years in SaaS security/GRC, familiarity with GCP and regulatory frameworks (NIST/PCI/ISO/SOC 2), and

Qualifications

• 5+ years in SaaS GRC or information security.
• Experience with regulatory standards and security frameworks.
• Familiar with GCP, AI architectures and data governance.
• BS degree or equivalent experience; certifications a plus.
• Strong communication and collaboration skills.
• Willingness to work across teams in a fast-paced environment.

Responsibilities

• Drive automation of controls within SDLC.
• Design and implement controls to ensure compliance.
• Provide guidance on product features and infrastructure changes.
• Support audits with documentation.
• Collaborate with cross-functional teams to close control gaps.
• Participate in security strategy planning and execution.

Skills

GRC Controls

Automation

SaaS security

Cloud security

Regulatory frameworks

Communication skills

Education

BS in Business or MIS

Tools

GCP

AI architectures

Data governance tools

Model validation

Job description

Box is seeking a seasoned GRC Controls Automation Engineer to embed compliance into software development. You’ll design, implement, and automate controls across the SDLC, guiding product features and infrastructure changes to improve security posture.

You’ll work with cross-functional teams and stakeholders, driving continuous improvement in a fast-paced, AI‑driven environment. You bring 5+ years in SaaS security/GRC, familiarity with GCP and regulatory frameworks (NIST/PCI/ISO/SOC 2), and