GRC Engineer

Wilson Sonsini Goodrich & Rosati, Professional Corporation; Iowa; On-site; USD 117,000 - 158,000; Full time

Job summary

Wilson Sonsini is seeking a mid-level GRC Engineer in Palo Alto to support governance, risk and compliance initiatives. The role focuses on aligning controls to NIST CSF, managing risk registers, and delivering risk and compliance metrics for leadership.

The ideal candidate will have 3+ years in GRC, strong knowledge of NIST standards, IT fundamentals, and experience with SIEM and GRC platforms. A degree in information security or related field is required, with certifications preferred.

Qualifications

• 3+ years of experience in security risk, governance, and compliance (GRC).
• Security operations or incident response experience with demonstrated GRC exposure.
• Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, SP 800-39.
• Working knowledge of IT fundamentals including networking, identity and access management, and cloud security (Azure).
• Excellent written and verbal communication skills.
• Ability to manage multiple priorities and work independently.

Responsibilities

• Framework Alignment and Control Mapping to NIST CSF and related standards.
• Risk Management and GRC tooling management and reporting.
• Threat and risk analysis using SIEM, vulnerability scanners and cloud security tools.
• Awareness, third-party risk and client assurance activities.

Skills

NIST CSF

Risk assessment

GRC tooling

SIEM analysis

Scripting (Python/PowerShell/KQL)

Cloud security

Communication

Project management

Education

Associate/Bachelor in information security/IT/risk management

Certifications preferred (e.g., Security+, CISA, CRISC, 27001 Lead Implementer/Auditor, SC-200/AZ-500)

Tools

ServiceNow

RSA Archer

Microsoft Sentinel

Splunk

Vulnerability scanners

Job description

Wilson Sonsini is the premier legal advisor to technology, life sciences, and other growth enterprises worldwide. We represent companies at every stage of development, from entrepreneurial start-ups to multibillion-dollar global corporations, as well as the venture firms, private equity firms, and investment banks that finance and advise them. The firm has approximately 1,100 attorneys in 17 offices: 13 in the U.S., two in China, and two in Europe. Our broad spectrum of practices and entrepreneurial spirit allow exceptional opportunities for professional achievement and career growth.

The GRC Engineer a mid-level position the works under the direction of the governance, risk and compliance leadership and reports to the Manager of IT Risk Operations. The position is technical and analytical in nature and requires a self-directed professional who is committed to applying industry best practices in the areas of governance, risk, and compliance.

Essential Duties and Responsibilities

• Framework Alignment and Control Mapping: Contribute to the implementation and maintenance of the client’s NIST Cybersecurity Framework (CSF) program, including tracking progress against current and target profiles and supporting assessments against related standards (e.g., ISO/IEC 27001, CIS Controls, SOC 2). Map the security controls in the current environment to NIST requirements (e.g., SP 800-53) and other applicable frameworks, perform gap analyses and self-assessments, and identify gaps for remediation. Support delivery of the client’s current security risk and compliance standards and maintain related documentation.
• Risk Management and GRC Tooling: Record and maintain security risks in the Risk Register, and coordinate with other teams as needed to obtain status and provide insights for remediation of risks. Contribute to the ServiceNow implementation (e.g., requirements, testing, and workflow input). Identify critical/high-risk systems and processes and document the associated risk profiles. Resolve tickets assigned to the governance, risk and compliance team and track them to closure. Prepare and deliver periodic risk, compliance, and service-level metrics and reports for the client’s program, tailored to leadership and stakeholder audiences.
• Threat and Risk Analysis: Gather and analyze data from various IT systems and security tooling (e.g., SIEM and log sources, unauthorized access attempts, phishing reports) that identify risk, and create reports that provide specific details. Use threat, vulnerability, and endpoint/cloud security management systems and tools (e.g., SIEM, vulnerability scanners, Microsoft Defender) to identify critical/high-risk systems, create threat analysis reports, initiate follow-up action, and help reduce risk. Partner with security operations and incident response teams to translate incident and vulnerability trends into risk register entries and remediation recommendations, and maintain related standard operating procedures. Analyze policies, systems, hardware, software, cloud, and network infrastructure and recommend methods and strategies that reduce risk.
• Awareness, Third-Party Risk and Client Assurance: Administer the cybersecurity awareness training program (e.g., assigning courses, tracking completion, and reporting results). Conduct Third-Party Risk Management analysis, including review of vendor security documentation and recording of results. Complete security questionnaires and provide supporting documentation within agreed turnaround times. Perform other related duties as assigned by the client’s governance, risk and compliance leadership.

Education and/or Work Experience Requirements

• 3+ years of experience in security risk, governance, and compliance (GRC). Security operations or incident response experience with demonstrated GRC exposure (e.g., control assessments, audits, compliance reporting) will be considered.
• Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, and SP 800-39, with an understanding of the cybersecurity risk assessment process.
• Working knowledge of IT fundamentals, including networking, identity and access management (e.g., Active Directory), and cloud security (e.g., Microsoft Azure).
• Excellent written and verbal communication skills, with the ability to explain risk to technical and non-technical audiences.
• Strong organizational, interpersonal, and critical thinking skills, with the ability to manage multiple priorities under pressure, work independently, and collaborate with diverse teams.
• Sound judgment, high ethical standards, and the discretion to handle confidential client information.
• Ability to respond promptly to unplanned requests within agreed service-level expectations and to accurately estimate time and resources for projects.
• Commitment to continuous learning of new technologies, frameworks, and skills.
• Associate’s or Bachelor’s degree in information security, information technology, risk management, or a related field, or equivalent combination of education, certification, and experience.
• Relevant certifications preferred (e.g., CompTIA Security+, CISA, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, Microsoft SC-200 or AZ-500).
• Preferred: Law firm experience, including responding to client security questionnaires and reviewing outside counsel guidelines.
• Experience with a GRC platform (e.g., ServiceNow, RSA Archer) and with SIEM, vulnerability, or threat management tools (e.g., Microsoft Sentinel, Splunk).
• Scripting or automation experience (e.g., Python, PowerShell, KQL) to streamline recurring GRC reporting and data-gathering.
• Working knowledge of Claude, Legora, BitSight, and/or Prompt Armor.

The primary location for this job posting is in Palo Alto.

The anticipated pay range for this position is as follows: $116,875 - $158,125 per year.

The compensation for this position may include a discretionary year-end merit bonus based on performance. We offer a highly competitive salary and benefits package. Benefits information can be found here. Equal Opportunity Employer (EOE).

Wilson Sonsini is the premier legal advisor to technology, life sciences, and growth enterprises worldwide, as well as the venture firms, private equity firms, and investment banks that finance them. We represent more than 300 public enterprises and 3,000 private companies in a wide range of today’s cutting-edge industries, from AI and fintech to life sciences and mobility. For more than 60 years, our attorneys and professional staff have created a unique working environment. With deep roots in the fast-paced and innovative world of Silicon Valley, the firm fosters an entrepreneurial spirit and team-orientated approach for all employees, providing professional and personal development opportunities and encouraging all departments to promote a stable and optimal work/life balance.

Wilson Sonsini is committed to creating a diverse and inclusive workforce globally. We have built a culture in which employees of all backgrounds, viewpoints, and experiences are encouraged and empowered to achieve their maximum potential. Our firm is consistently recognized among the top law firms in annual diversity rankings. For example, Wilson Sonsini ranked No. 2 among firms with more than 601 attorneys in Law360’s 2025 Diversity Snapshot. Additionally, in 2025, for the seventh consecutive year, Wilson Sonsini achieved Mansfield Plus Certification, and in 2026, for the sixth consecutive year, the firm achieved a top score of 100 on the Human Rights Campaign Foundation’s Corporate Equality Index.

We are also dedicated to enhancing the communities in which we live and work by providing legal services, financial support, and volunteer services to worthy agencies and individuals in need. In 2025, Wilson Sonsini attorneys and staff provided more than 80,500 pro bono hours, participated in 125 community service projects, and raised over $130,000 for charitable organizations and causes. In addition, the Wilson Sonsini Foundation contributed more than $2.35 million to 112 law-related organizations and 129 community organizations in 2025.

Wilson Sonsini has 17 offices in 16 technology and business hubs worldwide. Austin, TX Boston, MA Boulder, CO Brussels, Belgium Century City, CA Hong Kong London Los Angeles, CA New York, NY Palo Alto, CA Salt Lake City, UT San Diego, CA San Francisco, CA Seattle, WA Shanghai (China) Washington, D.C. Wilmington, DE