GRC Engineer - AI-Driven Compliance & Assurance

Legora; New York (NY); On-site; Confidential; Full time

Benefits offered by this job

Medical plans

Dental plans

Vision plans

401K

Unlimited PTO

Lunch daily at office

Maven Clinic

Commuter benefits

Identity protection

Legal coverage

Job summary

Legora is seeking a GRC Lead to build and operate the platform that runs our assurance program. You’ll design pipelines aggregating evidence across the stack, enforce policy in CI/CD, and draft audit-ready outputs.

This is a security-engineering role with a compliance focus, essential to our AI-enabled product for law firms. You’ll collaborate with Engineering, Corporate Security, and Product to certify ISO/IEC 42001 compliance, while translating complex regulations into automated checks and

Qualifications

• 5+ years spanning software or automation engineering and security compliance — an engineer who learned GRC, or a GRC operator who became a builder.
• Production-grade scripting (Python or similar) against APIs — code you ship and own.
• Hands-on experience building LLM/agent workflows and daily use of AI in your own work, with grounded judgment on what to delegate to agents, what needs a human, and how to evidence both to an auditor.
• Enough GRC domain fluency to work inside SOC 2 / ISO 27001 control language and know what an auditor will accept as evidence.
• Clear technical writing — your evidence and documentation will be read by auditors and customer security teams.

Responsibilities

• Build the pipelines and integrations that aggregate control, asset, and identity data across our stack (cloud, IdP, HRIS, source control, CI/CD) and turn it into automated checks, live dashboards, and audit evidence.
• Implement the unified controls library so one control satisfies many frameworks, with evidence collected once and mapped everywhere.
• Ingest from what partners already own — Corporate Security’s technical controls, the SaaS portfolio’s system of record — rather than building parallel collectors; system owners keep their evidence, your platform makes it audit-ready.
• Build the technical evidence base for our AI certifications (ISO/IEC 42001 and emerging AI-agent assurance standards): agent action logging, evaluation evidence, tool-call restrictions, and failure-mode documentation, working with Product and Engineering.
• Translate written policies and regulatory requirements into enforceable rules: automated checks in CI/CD and infrastructure deployment, continuous controls monitoring, and drift alerts routed to owners.
• Instrument control effectiveness so the GRC Lead reports risk posture from live data.
• Design and run agentic workflows for evidence analysis, control testing, and audit response preparation, with a human in the loop where assurance demands it. Anything manual twice a quarter gets automated.

Skills

GRC knowledge

Python scripting

LLM/agent workflows

Technical writing

SOC 2 / ISO 27001 control language

Tools

Terraform

CI/CD tooling

APIs

Job description

Legora is seeking a GRC Lead to build and operate the platform that runs our assurance program. You’ll design pipelines aggregating evidence across the stack, enforce policy in CI/CD, and draft audit-ready outputs.

This is a security-engineering role with a compliance focus, essential to our AI-enabled product for law firms. You’ll collaborate with Engineering, Corporate Security, and Product to certify ISO/IEC 42001 compliance, while translating complex regulations into automated checks and