GRC Engineer — NIST-Driven Risk & Compliance Lead

Wilson Sonsini Goodrich & Rosati, Professional Corporation; Iowa; On-site; USD 117,000 - 158,000; Full time

Job summary

Wilson Sonsini is seeking a mid-level GRC Engineer in Palo Alto to support governance, risk and compliance initiatives. The role focuses on aligning controls to NIST CSF, managing risk registers, and delivering risk and compliance metrics for leadership.

The ideal candidate will have 3+ years in GRC, strong knowledge of NIST standards, IT fundamentals, and experience with SIEM and GRC platforms. A degree in information security or related field is required, with certifications preferred.

Qualifications

• 3+ years of experience in security risk, governance, and compliance (GRC).
• Security operations or incident response experience with demonstrated GRC exposure.
• Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, SP 800-39.
• Working knowledge of IT fundamentals including networking, identity and access management, and cloud security (Azure).
• Excellent written and verbal communication skills.
• Ability to manage multiple priorities and work independently.

Responsibilities

• Framework Alignment and Control Mapping to NIST CSF and related standards.
• Risk Management and GRC tooling management and reporting.
• Threat and risk analysis using SIEM, vulnerability scanners and cloud security tools.
• Awareness, third-party risk and client assurance activities.

Skills

NIST CSF

Risk assessment

GRC tooling

SIEM analysis

Scripting (Python/PowerShell/KQL)

Cloud security

Communication

Project management

Education

Associate/Bachelor in information security/IT/risk management

Certifications preferred (e.g., Security+, CISA, CRISC, 27001 Lead Implementer/Auditor, SC-200/AZ-500)

Tools

ServiceNow

RSA Archer

Microsoft Sentinel

Splunk

Vulnerability scanners

Job description

Wilson Sonsini is seeking a mid-level GRC Engineer in Palo Alto to support governance, risk and compliance initiatives. The role focuses on aligning controls to NIST CSF, managing risk registers, and delivering risk and compliance metrics for leadership.

The ideal candidate will have 3+ years in GRC, strong knowledge of NIST standards, IT fundamentals, and experience with SIEM and GRC platforms. A degree in information security or related field is required, with certifications preferred.