GRC Engineer

Cloudflare; Austin (TX); On-site; USD 150,000 - 210,000; Full time

Benefits offered by this job

Equity plan

Medical insurance

401(k) plan

Flexible PTO

Job summary

Cloudflare in Austin is seeking a seasoned Security Governance, Risk and Compliance (GRC) professional to design and implement automated controls across the organization. The role focuses on scaling GRC processes and integrating security into product development and operations.

You will lead AI governance, collaborate with Legal, People, Engineering and Finance, and support audits (SOC 2, ISO 27001, PCI DSS, FedRAMP) while maintaining a secure, compliant edge network for customers worldwide.

Qualifications

• 5+ years of experience in security, compliance, automation, or engineering in a fast-paced environment.
• Builder mindset: enjoy building technical solutions over manual checkboxes.
• Experience designing or implementing AI-powered automation and agentic workflows with an understanding of non-deterministic risks.
• Deep experience with Infrastructure-as-Code (Terraform, Pulumi) and Policy-as-Code (OPA/Rego).
• Proficient in Python, Go, or other scripting languages; comfortable with REST APIs and modern web apps (JavaScript/TypeScript, React).
• Curious, empathetic, and results-driven; collaborates across teams.

Responsibilities

• Develop and implement automated solutions to improve GRC processes, integrating with security, engineering, and AI tools.
• Architect and maintain a governance framework for autonomous AI agents within risk thresholds.
• Support audits (SOC 2, ISO 27001, PCI DSS, FedRAMP) and maintain automated drift detection and self-healing configurations.
• Collaborate with Legal, People, Engineering, and Finance to embed security into the product.

Skills

Python

Go

REST APIs

JavaScript/TypeScript

React

Automation

GRC

Tools

Terraform

Pulumi

OPA/Rego

Job description

About Cloudflare

At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company.

Location

Austin, TX

The Role

Security Governance, Risk and Compliance (GRC) is a sub‑team of Security focused on ensuring Cloudflare has the right controls in place to secure our systems and customer data. The team works cross‑functionally with almost every team at Cloudflare to implement new controls, manage risk, and demonstrate our security posture to auditors and customers.

What You’ll Do

• Automation & Engineering: Develop and implement automated solutions to improve GRC processes and operations, integrating with existing security, engineering, and AI tools. Build modules and maintain our GRC platform and other similar initiatives.
• AI Governance: Architect and maintain a technical governance framework for the safe deployment of autonomous AI agents, ensuring that agentic workflows operate within deterministic “action gates” and predefined risk thresholds.
• Audit & Infrastructure: Support Cloudflare’s security assessments (e.g., SOC 2, ISO 27001, PCI DSS, FedRAMP). Treat “Audit Readiness” as a product, ensuring our global edge network remains compliant through automated drift detection and self‑healing configurations.
• Security Integration: Work cross‑functionally with Legal, People, Engineering, and Finance teams to integrate security into the fabric of the company, moving away from “gatekeeping” toward a paved‑road security model where compliance is the default state for every developer.

Qualifications

• 5+ years of experience in security, compliance, automation, or engineering functions in a fast‑paced environment.
• Builder mindset: enjoy building technical solutions to complex problems – prefer scripts over manual checkboxes.
• Experience designing or implementing AI‑powered automation and agentic workflows with an understanding of the unique risks of non‑deterministic systems.
• Deep experience with Infrastructure-as-Code (Terraform, Pulumi) and Policy-as-Code (OPA/Rego) implementation. Know how to enforce security guardrails before code is deployed.
• Proficient in Python, Go, or other scripting languages for automation, API interactions, and data parsing. Comfortable working with REST APIs, building modern web applications, including JavaScript/TypeScript and React, and collaborating across frontend and backend boundaries.
• Driven by curiosity, anchored by empathy, and defined by a relentless ability to get things done. Seek to understand the “why,” support peers, and ship high‑quality outcomes.

Bonus Points

• Demonstrated passion for security and software development; personal projects, open‑source contributions, or active participation in the security research community.
• Experience building on Cloudflare’s developer platform (e.g., Cloudflare Workers, R2, D1, or Workers AI). Understanding our ecosystem from hands‑on use.

Compensation & Benefits

Equity: This role is eligible to participate in Cloudflare’s equity plan.

Benefits: Cloudflare offers a complete package of benefits and programs to support you and your family, including medical, dental, vision insurance, a 401(k) plan with company match, flexible paid time off, and fertility & family‑forming benefits.

Application & Accommodations

Applicants who progress to the offer stage may be asked to attend an in‑person interview at one of our offices or hubs. The position may require access to information protected under U.S. export control laws; offers may be conditional on authorization to receive software or technology controlled under such laws without sponsorship. If you require a reasonable accommodation to apply for a job, please contact us at [e-mail] or 101 Townsend St., San Francisco, CA 94107.

EEO Statement

Cloudflare is proud to be an equal‑opportunity employer. We are committed to providing equal employment opportunity for all people and place great value in both diversity and inclusiveness. All qualified applicants will be considered for employment without regard to race, color, religion, sex, gender, gender identity, sexual orientation, national origin, ancestry, citizenship, age, physical or mental disability, medical condition, family care status, or any other basis protected by law. We are an AA/Disabled/veterans employer and provide reasonable accommodations to qualified individuals with disabilities.