GRC Engineer: Build Automated Compliance Pipelines

Reflection; San Francisco (CA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Top-tier compensation

Stock options

Health & wellness

Meals provided in office

Parental leave

Unlimited PTO in the U.S.

Job summary

Reflection AI is seeking a Governance, Risk, & Compliance engineer to build compliance as a product. You will design and maintain automated controls, engage with engineering and security teams, and translate policy requirements into scalable technical solutions.

You will help automate SOC 2, ISO 27001, and NIST processes, integrate GRC tooling, and support regulatory due diligence while collaborating across compliance, legal, and engineering stakeholders.

Qualifications

• 3–6 years of software/ security engineering or DevOps experience.
• Hands-on experience supporting at least one security framework (SOC 2, ISO 27001, or NIST).
• Proficient in Python and API integration.
• Translate policy requirements into technical specifications for engineering teams.
• Familiar with cloud infrastructure and identity/access management concepts.
• Experience building or maintaining GRC tooling or vendor risk platforms (e.g., Vanta).
• Background in government contracting or regulated environments.

Responsibilities

• Design and build automated controls and monitoring for security framework requirements (SOC 2, ISO 27001, NIST, etc.).
• Collaborate with Engineering, Security, and IT to implement regulatory requirements.
• Develop internal tooling to support compliance workflows (forms, screening, dashboards, GRC integrations).
• Translate regulatory and policy requirements into concrete technical specs for engineering teams.
• Support technical due diligence for security questionnaires, audits, and vendor assessments.
• Maintain integrations between GRC systems and source-of-truth systems (identity, data, models).
• Assist with scoping environmental boundaries required for regulatory compliance.

Skills

Python

APIs & integrations

Cloud familiarity

GRC tooling

DevOps / Infra

Collaboration

Tools

Vanta

SOC 2

ISO 27001

NIST

Job description

Reflection AI is seeking a Governance, Risk, & Compliance engineer to build compliance as a product. You will design and maintain automated controls, engage with engineering and security teams, and translate policy requirements into scalable technical solutions.

You will help automate SOC 2, ISO 27001, and NIST processes, integrate GRC tooling, and support regulatory due diligence while collaborating across compliance, legal, and engineering stakeholders.