GRC Engineer

Forward; Santa Clara (CA); On-site; USD 140,000 - 170,000; Full time

Job summary

Forward is seeking a GRC Engineer to build compliance automation, manage SOC 2 audits, and integrate governance into engineering workflows. You’ll develop tests and controls, pull evidence from source systems, and extend our GRC platform with scripts and APIs.

Initial work focuses on automation, audit management, and risk assessment, with growth into SecOps tasks such as SIEM/SOAR tuning and incident response. This role blends compliance and security engineering.

Qualifications

• 3+ years in GRC, compliance, security engineering, IT audit, or equivalent.
• Experience writing policies and procedures with testable outcomes.
• Hands-on work with GRC automation platforms (Vanta, Drata, Thoropass, Anecdotes).
• SOC 2 knowledge; ISO 27001 is a plus; ISO 42001 is a future consideration.
• Basic scripting: Python or Bash, SQL; able to pull data from APIs and parse logs.

Responsibilities

• Write and maintain security policies and procedures.
• Automate control testing by verifying real system configurations at the source.
• Manage GRC platforms via scripts and API integrations.
• Monitor control drift and drive remediation.
• Lead SOC 2 Type II audits and support ISO 27001/42001 groundwork.
• Maintain risk register and perform risk assessments.
• Coordinate vendor security reviews and evidence collection.
• Collaborate with engineering to embed requirements in CI/CD and access management.
• After automations, contribute to SIEM/SOAR and incident response.

Skills

GRC

Policy writing

Automation scripting

SOC 2 knowledge

SIEM/SOAR

APIs

Auditor communication

Ambiguity tolerance

Endpoint security

Tools

Vanta

Drata

THOROPASS

Anecdotes

Splunk

Chronicle

Panther

XSOAR

Tines

Job description

Forward was founded in 2013 by four Stanford Ph.D.s, building the industry's first network digital twin: a mathematically accurate model of the production network. It's the foundation for autonomous networking, giving engineers and AI agents the ability to know the impact of every change before it touches production. That founding instinct still defines how we work. We're accurate and evidence-driven, relentless about clarity, and we'd rather be certain than comfortable, building a groundbreaking platform that transforms how teams run and secure networks across every major cloud and vendor environment.
Global leaders like Goldman Sachs, PayPal, S&P Global, IBM, and Dell trust Forward, alongside fast-growing enterprises and government agencies, realizing an average of $14.2 million in annual benefits, according to IDC. Backed by top-tier investors, including A. Capital, Andreessen Horowitz, Goldman Sachs, MSD Partners, Omega Venture Partners, Section 32, and Threshold Ventures, and headquartered in Santa Clara, we're most proud of our team: curious people who'd rather build what doesn't exist than accept how things have always been done.
Forward is looking for a GRC Engineer. GRC Engineering is a new discipline: instead of chasing down screenshots every quarter and hoping the auditor doesn't ask too many follow-up questions, you're building scripts and API integrations that pull evidence straight from the source systems and keep it current on their own. If you've spent any time reading about the field, you've probably run into grc.engineering, the GRC Engineering Club, or grcengineer.com. We'd rather hire someone who already thinks this way than someone who needs to be convinced of it; if your engineering skills enable doing more than a traditional GRC Analyst role, you're the right fit.
Your initial focus, likely for the next 6 months, is GRC Engineering: compliance automation, audit management (SOC 2, ISO 27001/42001), control design and testing, and risk management.
Once the most critical automations are in place, this job broadens to include a Security Operations piece: mostly SIEM and SOAR work plus whatever incident response comes up. This is your chance to go beyond mere exposure to SecOps work, to directly participate in alert triage, SIEM/SOAR administration and tuning, enforcement work, and incident response. This is a real split, and we're looking for someone who can grow to handle both types of work.

What You'll Do

GRC Engineering (main focus of role)

• Policy & Documentation: Write, maintain, and actively drive review cycles for security policies and procedures.
• Automated Control Testing: Build control tests that verify real system configurations directly at the source, rather than manual spreadsheets. If a control says MFA is enforced, you should be able to verify that in the identity provider yourself.
• Manage and extend our GRC platform (Vanta, Drata, etc.) using scripts and API integrations.
• Control Monitoring: Continuously manage control drift between audits and drive remediation to completion.
• Audit Management: Lead day-to-day SOC 2 Type II audits and lay groundwork for ISO 27001 and ISO 42001.
• Risk Management: Maintain a prioritized risk register and run actionable risk assessments.
• Handle vendor security reviews and due diligence: pull evidence from a vendor's API or trust page, rather than mailing them a 40-question spreadsheet.
• Engineering Collaboration: Integrate compliance requirements directly into engineering workflows, such as CI/CD, access provisioning, and change management.

Security Operations (additional Piece After Critical Automations In Place)

• SIEM & SOAR Admin: Tune detection rules, correlation logic, and response playbooks.
• Endpoint Support: assist with EDR, DLP, and endpoint break/fix and incident response cases.
• Alert Triage: Participate in security alert triage and documentation.
• Jump into incident response when something happens: investigation, helping contain it, and post-mortem write-ups.
• Feed what you see in the SOC back into the GRC side of your job. If operations tell a different story than what the compliance platform says, that gap is worth knowing about.

What We're Looking For

• 3+ years in GRC, compliance, security engineering, IT audit, or equivalent, with on-the-job exposure to control design, risk assessment, AND compliance frameworks.
• Experience writing policies and procedures, with a focus on testable and verifiable outcomes.
• Time spent doing real work in a GRC/compliance automation platform (Vanta, Drata, Thoropass, Anecdotes, or similar).
• Solid working knowledge of SOC 2. ISO 27001 experience is a plus. ISO 42001 is a possible future endeavor, but curiosity about AI governance is important.
• Basic scripting knowledge: Python or Bash, SQL, and comfortable pulling data from an API, parsing a log file, or automating something you used to do by hand. This is not a software engineer role and you will be able to take advantage of AI to assist, but the ability to read, troubleshoot, and deliver working scripts is a requirement.
• Some exposure to SIEM/SOAR tooling (Splunk, Chronicle, Panther, XSOAR, Tines, whatever you've used) and a basic feel for how incident response actually runs.
• The ability to speak to an auditor and an engineer in languages they understand, as both the GRC and engineering skill sets will be utilized.
• A tolerance for ambiguity. "GRC Engineer" is an evolving field/role. We will be figuring out parts of this role as time goes on together.
• Experience with endpoint compliance in a Mac-centric environment.

Nice to Have

• We run in the cloud but also still operate our own data center, so comfort with straight Linux administration and scripting matters just as much as anything cloud-native. If you've worked with Terraform or policy-as-code, that helps too.
• Certs like Security+, CISA, CISSP, or ISO 27001 Lead Implementer/Auditor are fine to have. We just care more about whether you can trace a control back to the system it's actually describing.
• Time spent tuning or migrating a SIEM/SOAR setup, or running incident response for real, not just in a tabletop exercise.
• Understanding tabletop exercises, how to run them, how to conduct a post-mortem and how to drive the findings to completion with stakeholders.

The base pay range for this role is between $140,000 and $170,000. This range represents the low and high end of the salary for this position. Actual compensation will vary based on factors including location, candidate experience, skills, and level.