GRC Controls Automation Engineer – Compliance & SDLC

Box; Redwood City (CA); On-site; USD 112,000 - 145,000; Full time

Job summary

Box, an AI-first company, seeks a GRC Controls Automation Engineer to bridge compliance with software development. You will modernize and scale automation frameworks, embedding compliance into the SDLC and collaborating with engineering, security, and product teams.

You will influence audits, advise on new features, and help Box maintain its high standards across ISO, PCI, NIST, and SOC frameworks while supporting Box’s growing customer footprint and regulatory requirements.

Qualifications

• 5+ years of professional experience in GRC, Information Security or similar in a SaaS company.
• Deep understanding of global frameworks such as NIST 800-53, PCI, ISO 27x, and SOC 2.
• CISSP, CCSK, CISM or related certifications are a plus.
• Excellent written, verbal communication and presentation skills.

Responsibilities

• Drive improvements in existing processes and develop new compliant automation solutions.
• Design, develop, and implement controls focusing on compliance and automation.
• Provide compliance guidance on new product features and infrastructure changes.
• Participate in cloud and application security strategic planning and execution.
• Monitor and identify compliance issues and coordinate cross-functional remediation.
• Build relationships with internal and external stakeholders.

Skills

GRC experience

Information Security

Communication skills

Education

BS degree in Business or MIS

Tools

GCP

AI architectures

Data governance

Job description

Box, an AI-first company, seeks a GRC Controls Automation Engineer to bridge compliance with software development. You will modernize and scale automation frameworks, embedding compliance into the SDLC and collaborating with engineering, security, and product teams.

You will influence audits, advise on new features, and help Box maintain its high standards across ISO, PCI, NIST, and SOC frameworks while supporting Box’s growing customer footprint and regulatory requirements.