GRC Engineer: Automate Compliance & Audits

APEX Fintech Services; Texas; On-site; USD 120,000 - 180,000; Full time

Job summary

Apex Fintech Solutions is seeking a GRC Engineer to help build and operate our governance, risk, and compliance program. This hands-on role blends audits, risk management, policy, and due diligence with engineering skills like API integrations, data querying, and control automation.

You'll support SOC 2, NIST CSF, ISO 27001 readiness and modernize evidence collection using platforms like Anecdotes and similar tools, working with auditors and internal teams.

Qualifications

• Audits and framework management experience (SOC 2, NIST CSF, ISO 27001) and ability to collaborate with external auditors.
• Experience building, maintaining, and maturing a GRC program across multiple standards.
• Comfort with API integrations, data querying, and evidence collection to support audits.

Responsibilities

• Own or co-own SOC 2 audits (Type I/II) preparation, scoping, evidence, and remediation with external auditors.
• Lead or support NIST CSF assessments and gap analyses with remediation planning.
• Support ISO 27001 readiness and other relevant frameworks (PCI DSS, GLBA, state/federal regulations).
• Maintain a unified control framework mapping overlapping requirements across standards.

Skills

Audits

Risk management

Policy development

Due diligence

API integrations

Data querying

Controls automation

GRC tooling

Education

Bachelor's degree in a relevant field

Tools

Anecdotes

Vanta

Drata

Secureframe

OneTrust

ServiceNow GRC

SQL

Job description

Apex Fintech Solutions is seeking a GRC Engineer to help build and operate our governance, risk, and compliance program. This hands-on role blends audits, risk management, policy, and due diligence with engineering skills like API integrations, data querying, and control automation.

You'll support SOC 2, NIST CSF, ISO 27001 readiness and modernize evidence collection using platforms like Anecdotes and similar tools, working with auditors and internal teams.