GRC Engineer: Continuous, Data-Driven Compliance

Plaid; New York (NY); On-site; USD 156,000 - 213,600; Full time

Job summary

Plaid is seeking a Senior GRC Engineer in New York to own the GRC Engineering function, turning manual compliance into an engineered, continuous system. You will define architecture, build a codified source of truth for controls, policies, and evidence, and serve as the backbone for security assurance, vendor risk, and risk management.

You will turn control data into real-time risk signals, automate evidence collection and testing, and drive data-informed risk assessments across security, infra,

Qualifications

• Strong Python and SQL with API/webhook experience.
• Experience owning internal tools end-to-end with real users.
• AWS and cloud-native security controls experience.
• Dashboarding to turn risk data into KPIs.

Responsibilities

• Architect GRC's engineering foundation: codified controls, policies, and evidence as structured data.
• Build Continuous Controls Monitoring across cloud and on-premise systems.
• Turn data into risk signals with dashboards and real-time KPIs.
• Conduct data-driven risk assessments and mitigations.
• Automate recurring toil with durable automation across workstreams.
• Embed compliance checks into CI/CD and AI-powered workflows.

Skills

Python

SQL

API/webhook integrations

Internal tool ownership

AWS

Dashboard & visualization

Cross-functional collaboration

AI-assisted workflows

Education

Degree in CS/Cybersecurity or related field

Tools

Terraform

OPA/Rego

Sentinel

Mode

AWS

Job description

Plaid is seeking a Senior GRC Engineer in New York to own the GRC Engineering function, turning manual compliance into an engineered, continuous system. You will define architecture, build a codified source of truth for controls, policies, and evidence, and serve as the backbone for security assurance, vendor risk, and risk management.

You will turn control data into real-time risk signals, automate evidence collection and testing, and drive data-informed risk assessments across security, infra,