GRC Engineer: Automate SOC 2 & Compliance at Scale

AegisAI, Inc.; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

AegisAI is seeking a GRC Engineer to advance the security program and own SOC 2 end-to-end compliance. You will map controls across frameworks, automate evidence collection via APIs, manage audits and questionnaires, and drive policy updates as we scale.

You will work with the head of security, engineers, and customers to ensure fast, transparent responses that close deals while protecting data. This role emphasizes automation, privacy regimes, and third-party risk with a startup-speed culture.

Qualifications

• 4+ years in GRC, security compliance or audit at a SaaS company, with SOC 2 Type II experience.
• Writes clear answers to enterprise security questionnaires to close threads.
• Reads architecture diagrams and verifies controls across implementations.
• Scripting in Python or similar; comfortable with APIs and avoiding duplicate evidence.
• Familiar with major privacy regimes and data processor implications.
• Organized, self-directed, and honest about gaps.

Responsibilities

• Own Compliance end to end and manage auditor relationships.
• Prepare for new certifications with proactive framework alignment.
• Run the risk management program and maintain the risk register.
• Maintain the policy suite and ensure customers understand it.
• Own BC/DR and incident response plans and exercises.
• Answer security questionnaires and manage TPRM end to end.
• Manage vendor and subprocessor risk and DPAs.
• Map controls across industry frameworks and maintain evidence.
• Expand evidence automation via APIs and scripts.

Skills

SOC 2

Python scripting

APIs

Security questionnaires

Risk management

Policy writing

Vendor risk

Job description

AegisAI is seeking a GRC Engineer to advance the security program and own SOC 2 end-to-end compliance. You will map controls across frameworks, automate evidence collection via APIs, manage audits and questionnaires, and drive policy updates as we scale.

You will work with the head of security, engineers, and customers to ensure fast, transparent responses that close deals while protecting data. This role emphasizes automation, privacy regimes, and third-party risk with a startup-speed culture.