GRC Engineer

Verkada Inc.; San Mateo (CA); On-site; USD 200,000 - 250,000; Full time

Benefits offered by this job

Healthcare programs

Medical, vision and dental coverage

HSA with employer contributions

Mental health support

Parental leave & fertility benefits

Paid holidays & flexible PTO

Wellness/fitness benefits

Healthy lunches provided daily

Job summary

Verkada, a privacy-sensitive AI-powered security platform, is seeking a leader to build and run the GRCA function within its Security Team. You will manage risks, scale programs, and curate customer information about security practices as Verkada grows globally.

You will design automated controls, drive audits (SOC 2, ISO27001), collaborate across Security, IT, Engineering, Product and Legal, and will work onsite five days a week to ensure continuous compliance and trusted partnerships with

Qualifications

• Outstanding written and spoken communication skills.
• Ability to autonomously accomplish outcomes across cross-functional teams.
• Experience with audits, risk and compliance for cloud software (SOC 2, ISO27001).
• Prior experience with software companies’ compliance.

Responsibilities

• Work cross functionally with Security, IT, Engineering, Product and Legal to provide guidance on security controls implementation.
• Maintain roadmap for continuous security compliance across Corporate, IT and Product environments.
• Develop and maintain company-wide security policies and plans; communicate best practices.
• Coordinate with management on progress, escalations and resolutions.
• Create procedural documentation and training materials.
• Collaborate with stakeholders to achieve GRCA goals.
• Oversee corrective action plans and risk treatment.
• Perform annual security risk assessments and vendor assessments.
• Manage Security Exception Process and assurance program for customer questionnaires.
• Collaborate on Business Impact Assessments and BCP/DR activities.
• Leverage AI and automation to scale GRCA functions.
• Coordinate with internal and external auditors to ensure continuous compliance.
• Onsite work five days per week.

Skills

Communication

Cross-functional collaboration

Project management

AWS / Cloud

Audits & Compliance

SOC2 / ISO27001

Compliance experience in software

Scripting (Python/JSON)

Tools

AWS

Job description

Verkada is transforming how organizations protect their people and places with an integrated, privacy-sensitive AI-powered platform that includes solutions for video security, access control, air quality sensors, alarms, intercoms, and visitor management.

We’ve got serious momentum in the market: more than 30,000 customers (including 100+ of the Fortune 500), a $5.8B valuation , more than $1 billion in annualized bookings, and backing from CapitalG, Sequoia Capital, General Catalyst, Felicis Ventures, Next47 and more. Physical AI is one of the most consequential technology shifts of our time, and Verkada is at the center of it.

You can look at all kinds of communities to see our platform’s impact in the world. It's the retailer that uses our agentic AI to deter theft before it happens. The warehouse that uses AI-powered alerts to make sure its team is protected on the floor with proper PPE. The school that’s alerted to a threat in real-time and triggers a lockdown in seconds, not minutes. We’re rapidly scaling this impact: today, more than 2 million Verkada devices are deployed across 170+ countries.

About the Role

Build and lead the GRCA function within Verkada’s Security Team. Manage risks, scale and meet Verkada’s growing compliance needs. Curate information provided to customers about Verkada’s security practices.

You’ll build scalable, automated programs that enable rapid business growth while maintaining customer trust. As Verkada expands globally with increasing enterprise customers, this role is critical to meeting sophisticated security and compliance expectations that directly impact revenue and risk management.

What You’ll Do

• Work cross functionally with Security, IT, Engineering, Product and Legal to provide guidance on security controls implementation including: effectiveness, implementation and automation
  • Research, build and maintain tooling for testing and continuous monitoring of security controls across multiple platforms including: AWS, Github, etc.
• Maintain the roadmap for continuous security compliance across Verkada’s Corporate, IT and Product environments with a goal of increasing automation coverage
• Assist in the development and maintenance of company-wide security policies, procedures, and plans, and support communication to internal stakeholders regarding security and compliance best practices around applicable laws, regulations, and controls
• Communicate progress, escalations, and issue resolution to management and team stakeholders
• Create procedural documentation, including training materials or process documentation
• Build relationships with a broad range of Verkada employees at all levels to accomplish program objectives and further Verkada GRC goals.
• Implement the development and oversight of required corrective action plans relating to security compliance issues
• Perform annual security risk assessments and prepare risk treatment plans
• Conduct vendor security assessments to assess risks and evaluate security postures of new and existing third-party vendors/suppliers
• Manage the Security Exception Process to enable Security teams to track exceptions, manage approvals, and improve automation
• Assurance program (the A in GRCA) - Maintain the FAQ for customer questionnaires
• Collaborate on Business Impact Assessments (BIA) and annual BCP/DR activities
• Leverage AI and automation to scale the GRCA functions
• Work closely with internal and external auditors to educate them and achieve continuous compliance over technology control environment
• Must be willing and able to work onsite five days per week

What You Bring

• Outstanding written and spoken communication skills
• Ability to effectively and autonomously accomplish outcomes across cross-functional teams in ambiguous situations
• Ability to multitask, prioritize work and meet deadlines in a fast paced environment
• Experience with AWS or another cloud service provider
• Prior experience with software companies’ compliance
• Experience with audits, risk and compliance (SOC 2, ISO27001, etc.) for cloud software products.
• 7+ years of security/IT compliance or equivalent experience
• Bonus: Experience with scripting languages such as: Python, JSON etc

US Employee Benefits

Verkada is committed to fostering a workplace environment that prioritizes the holistic health and wellbeing of our employees and their families by offering comprehensive wellness perks, benefits, and resources. Our benefits and perks programs include, but are not limited to:

• Healthcare programs that can be tailored to meet the personal health and financial wellbeing needs - Premiums are 100% covered for the employee under at least one plan and 80% for family premiums under all plans
• Nationwide medical, vision and dental coverage
• Health Saving Account (HSA) with annual employer contributions and Flexible Spending Account (FSA) with tax saving options
• Expanded mental health support
• Paid parental leave policy & fertility benefits
• Time off to relax and recharge through our paid holidays, firmwide extended holidays, flexible PTO and personal sick time
• Wellness/fitness benefits
• Healthy lunches provided daily

Additional Information

• We do sponsor and take over sponsorship of employment visas for this role. If we make you an offer, we will make every reasonable effort to get you a visa.

Annual Pay Range

At Verkada, we want to attract and retain the best employees, and compensate them in a way that appropriately and fairly values their individual contribution to the company. With that in mind, we carefully consider a number of factors to determine the appropriate starting pay for an employee, including their primary work location and an assessment of a candidate's skills and experience, as well as market demands and internal parity. A Verkada employee may be eligible for additional forms of compensation, depending on their role, including sales incentives, discretionary bonuses, and/or equity in the company in the form of restricted stock units (RSUs)

$200,000 - $250,000 USD

As an equal opportunity employer, Verkada is committed to providing employment opportunities to all individuals. All applicants for positions at Verkada will be treated without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Verkada’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

• Alcohol or other substance use disorder (not currently using drugs illegally)
• Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
• Blind or low vision
• Cancer (past or present)
• Cardiovascular or heart disease
• Celiac disease
• Cerebral palsy
• Deaf or serious difficulty hearing
• Diabetes
• Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
• Epilepsy or other seizure disorder
• Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
• Intellectual or developmental disability
• Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
• Missing limbs or partially missing limbs
• Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
• Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
• Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
• Partial or complete paralysis (any cause)
• Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
• Short stature (dwarfism)
• Traumatic brain injury

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.