GRC Engineer: Compliance Automation & SecOps

Forward; Santa Clara (CA); On-site; USD 140,000 - 170,000; Full time

Job summary

Forward is seeking a GRC Engineer to build compliance automation, manage SOC 2 audits, and integrate governance into engineering workflows. You’ll develop tests and controls, pull evidence from source systems, and extend our GRC platform with scripts and APIs.

Initial work focuses on automation, audit management, and risk assessment, with growth into SecOps tasks such as SIEM/SOAR tuning and incident response. This role blends compliance and security engineering.

Qualifications

• 3+ years in GRC, compliance, security engineering, IT audit, or equivalent.
• Experience writing policies and procedures with testable outcomes.
• Hands-on work with GRC automation platforms (Vanta, Drata, Thoropass, Anecdotes).
• SOC 2 knowledge; ISO 27001 is a plus; ISO 42001 is a future consideration.
• Basic scripting: Python or Bash, SQL; able to pull data from APIs and parse logs.

Responsibilities

• Write and maintain security policies and procedures.
• Automate control testing by verifying real system configurations at the source.
• Manage GRC platforms via scripts and API integrations.
• Monitor control drift and drive remediation.
• Lead SOC 2 Type II audits and support ISO 27001/42001 groundwork.
• Maintain risk register and perform risk assessments.
• Coordinate vendor security reviews and evidence collection.
• Collaborate with engineering to embed requirements in CI/CD and access management.
• After automations, contribute to SIEM/SOAR and incident response.

Skills

GRC

Policy writing

Automation scripting

SOC 2 knowledge

SIEM/SOAR

APIs

Auditor communication

Ambiguity tolerance

Endpoint security

Tools

Vanta

Drata

THOROPASS

Anecdotes

Splunk

Chronicle

Panther

XSOAR

Tines

Job description

Forward is seeking a GRC Engineer to build compliance automation, manage SOC 2 audits, and integrate governance into engineering workflows. You’ll develop tests and controls, pull evidence from source systems, and extend our GRC platform with scripts and APIs.

Initial work focuses on automation, audit management, and risk assessment, with growth into SecOps tasks such as SIEM/SOAR tuning and incident response. This role blends compliance and security engineering.