GRC Engineer

APEX Fintech Services LLC; Texas; Hybrid; USD 110,000 - 170,000; Full time

Benefits offered by this job

Healthcare

PTO & leave

401k match

Parental leave

Wellness & learning

Job summary

Apex Fintech Solutions is seeking a GRC Engineer to help build, scale, and operate our governance, risk, and compliance program. This is a hands‑on role blending audits, risk management, policy work, and advanced engineering tasks such as API integrations and data querying.

You will support SOC 2 audits, NIST CSF, ISO 27001 readiness, and vendor risk programs while modernizing how we evidence controls using Anecdotes and similar tools.

Qualifications

• 2–5+ years of experience in GRC, information security compliance, IT audit, or related field.
• Hands-on experience with SOC 2 audits and practical evidence collection.
• Knowledge of NIST CSF and ISO 27001 (or similar frameworks).
• Experience with a GRC automation platform and API data ingestion.
• Strong SQL skills and ability to translate findings for auditors and executives.

Responsibilities

• Own or co‑own preparation for and execution of SOC 2 audits with external auditors.
• Lead or support NIST CSF assessments and remediation planning.
• Support ISO 27001 readiness and vendor risk management initiatives.
• Maintain a unified control framework and automate evidence collection via APIs.
• Analyze compliance data and produce audit‑ready evidence; maintain policy repositories.

Skills

SOC 2 audits

GRC automation

SQL

Policy drafting

Auditor liaison

Tools

Anecdotes

Vanta

Drata

Secureframe

OneTrust

ServiceNow GRC

Job description

WHO WE ARE

Apex Fintech Solutions (Apex) powers innovation and the future of digital wealth management by building tech-forward solutions that help simplify, automate, and facilitate access to financial markets for all. Our robust suite of fintech software enables us to support clients such as Stash, Betterment, SoFi, Webull, and eToro, amongst many others; collectively, Apex powers access to the stock market for over 22+ million end customers. At Apex, we are changing how the securities industry operates by reinventing the status quo, which was manual, slow, and accessible only by the ultra-wealthy. We're digitizing and democratizing systems so that everyone has an opportunity to invest. When you're at Apex, you drive this change. You're part of a global team with a clear vision: to be the trusted technology that powers the digital economy. Our offices in Austin, Dallas, Chicago, New York, Portland, Belfast, and Manila are home to over 1,000 employees. Together, we’re shaping the future of financial innovation. Embrace change. Solve big. Win together. And be G.R.E.A.T. — grit, results, empathy, accountability, and teamwork — with Apex. We’re proud to be recognized for the innovative work we do, the purpose-driven nature of our work, and the collaborative culture we’ve created.

Here are just a few of the many awards we’ve recently received: Best Places to Work 2026, 2025, 2024, 2023 - Presented by BuiltIn WealthTech of the Year 2025 - Presented by US FinTech Awards The World’s Top 250 Fintech Companies 2024 - Presented by CNBC

ABOUT THIS ROLE

Apex Fintech Solutions is looking for a GRC Engineer to help build, scale, and operate our governance, risk, and compliance program. This is a hands-on, technically minded role that blends traditional GRC responsibilities, including audits, risk management, policy, and due diligence, with engineering-oriented skills like API integrations, data querying, and control automation. You'll be a key player in maintaining our compliance posture across frameworks like SOC 2, NIST CSF, and ISO 27001, while also helping modernize how we monitor and evidence controls using platforms like Anecdotes. This role suits someone who is equally comfortable talking to auditors as they are writing a query to pull evidence out of a data pipeline.

What You’ll Do

• Own or co‑own preparation for and execution of SOC 2 (Type I/II) audits, working directly with external auditors to scope, evidence, and remediate findings
• Lead or support NIST CSF assessments and gap analyses, translating results into actionable remediation plans
• Support alignment and readiness activities for ISO 27001 and other relevant frameworks (e.g., PCI DSS, GLBA, state/federal financial regulations as applicable)
• Maintain a unified control framework that maps overlapping requirements across multiple standards to reduce duplicate effort
• Build and maintain continuous compliance monitoring using GRC platforms such as Anecdotes (or equivalent tools like Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC)
• Configure and manage automated evidence collection via API integrations with cloud, identity, ticketing, and infrastructure systems
• Design and implement controls that consume ingested data, ensuring accuracy, freshness, and appropriate alerting on control drift or failures
• Query and analyze compliance and security data (SQL or platform‑native query languages) to validate control effectiveness and produce audit‑ready evidence
• Maintain the organization’s control library, risk register, and policy/procedure repository
• Support enterprise risk assessments, including identification, scoring, tracking, and remediation of risks
• Maintain third‑party/vendor risk management processes, including vendor risk assessments and ongoing monitoring
• Partner with security, engineering, and business teams to ensure risks are understood, owned, and addressed on a reasonable timeline
• Respond to Due Diligence Questionnaires (DDQs), RFPs, and customer security questionnaires with accurate, timely, and well‑documented answers
• Maintain a trust center / security documentation repository to streamline recurring due diligence requests
• Act as a subject matter resource for prospects, customers, and partners on Apex’s security and compliance posture
• Draft, maintain, and periodically review information security and compliance policies and procedures
• Ensure policies remain aligned with current frameworks, regulatory obligations, and actual operational practice
• Support policy attestation, training, and awareness campaigns
• Support internal and external audit logistics, evidence requests, and stakeholder coordination
• Contribute to metrics and reporting for leadership and the board on compliance and risk posture
• Continuously look for opportunities to automate manual GRC workflows

What We’re Looking For

Required:

• 2–5+ years of experience in GRC, information security compliance, IT audit, or a closely related field
• Hands‑on experience with SOC 2 audits (as a practitioner preparing evidence, not just an auditor)
• Working knowledge of NIST CSF and ISO 27001 (or similar frameworks like PCI DSS, HITRUST)
• Experience with a GRC automation platform (Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC, or similar)
• Comfort working with API integrations to ingest data for compliance monitoring and control building
• Working proficiency in SQL or similar query languages to analyze and validate compliance data
• Experience drafting and maintaining information security policies and procedures
• Strong written and verbal communication skills, able to translate technical findings for both auditors and executives
• Ability to manage multiple concurrent audits/assessments and shifting priorities

Preferred:

• Experience in fintech, financial services, or another regulated industry
• Familiarity with vendor/third‑party risk management programs and DDQ response processes
• Exposure to cloud environments (AWS, Azure, or GCP) and common security tooling (IAM, SIEM, ticketing systems)
• Scripting ability (Python, or similar) for light automation of GRC workflows
• Relevant certifications: CISA, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor, or similar

Our Rewards

We offer a robust package of employee perks and benefits, including healthcare benefits (medical, dental and vision, EAP), competitive PTO, 401k match, parental leave, and HSA contribution match. We also provide our employees with a paid subscription to the Calm app and offer generous external learning and tuition reimbursement benefits. At AFS, we offer a hybrid work schedule for most roles that allows employees to have the flexibility of working from home and one of our primary offices.

EEO Statement

Apex Fintech Solutions is an equal opportunity employer that does not discriminate on the basis of race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age, disability, veteran status, marital status, or any other protected characteristic. Our hiring practices ensure that all qualified applicants receive fair consideration without regard to these characteristics.

Disability Statement

Apex Fintech Solutions is committed to creating an inclusive and accessible workplace for all candidates, including those with disabilities. We are dedicated to ensuring equal employment opportunities and providing reasonable accommodations to qualified individuals with disabilities. If you require reasonable accommodations to participate in the application or interview process, please submit your request via the Candidate Accommodation Requests Form. We will work with you to provide the necessary accommodations to ensure your full participation in our hiring process.

At Apex, we aim to enable frictionless investing for everyone. At Apex, we stand for efficiency and transparency. In every office, you’ll find passionate, committed, dedicated teams driven to find smart solutions to solve our clients’ toughest challenges. We are passionate about our employees, providing the benefits and perks that elevate you, reward you, and help you give back. We provide great flexibility, a collaborative, open work space, and real potential to grow with the firm.