GRC Staff Engineer

Fivetran, Inc.; Michigan; Hybrid; USD 140,000 - 190,000; Full time

Job summary

Fivetran, Inc. is seeking a GRC Senior Engineer in Oakland to build a security data lake and drive continuous control monitoring. You will work with Security, IT, Engineering, Legal and Finance to automate audits and improve risk visibility.

This hybrid role requires 5+ years in GRC/security, strong SQL/Python, and knowledge of ISO/SOC/PCI/HITRUST with cloud security controls.

Qualifications

• 5+ years in GRC, security or data engineering.
• Strong SQL and Python for automation.
• Experience with modern data stack and data lakes.
• Automation of control testing and compliance processes.
• Knowledge of ISO 27001, SOC 2, PCI DSS, HITRUST.
• Familiarity with AWS/GCP/Azure security controls.
• Translate control language into technical tests.
• Clear written communication across Security, IT, Engineering, Legal, and Finance.

Responsibilities

• Build and maintain a security data lake powering continuous control monitoring.
• Govern the lake: data quality, retention, least privilege, sensitive-data handling.
• Develop compliance-as-code: evidence collection, CCM, policy-as-code across cloud, Kubernetes, CI/CD, identity, and SaaS.
• Integrate GRC tooling with APIs, scripts, and workflows to replace manual audit work with real-time visibility.
• Support certifications and attestations (ISO, PCI DSS, SOC 2, HITRUST).

Skills

GRC

Security engineering

Data engineering

SQL

Python

Automation

Audit/compliance

Cloud security

Job description

From the company’s founding until now, our mission has remained the same: to make access to data as simple and reliable as electricity. With the company, customer data arrives in their warehouses, canonical and ready to query, with no engineering or maintenance required. We’re proud that more organizations continue to leverage our technology every day to become truly data-driven.

About Us

the company and dbt Labs are bringing together two industry-leading companies with a shared mission: helping organizations unlock the full value of their data. Together, we’re delivering the data infrastructure layer that helps organizations move, transform, and trust their data — from the moment data moves, through every transformation, to the context teams and AI systems rely on. the company helps organizations automate data movement across the systems, clouds, engines, and tools they rely on. dbt Labs pioneered analytics engineering, helping teams transform data into reliable, governed insights. Together, we support thousands of organizations as they build a trusted foundation for analytics, AI, and better business decisions. As we bring our teams and technology together, we’re building on the strengths of both companies while continuing to deliver the products and experiences our customers know and trust. It’s an exciting time to join us: we’re creating a company with the scale, talent, and technology to help more organizations put their data to work with greater speed, confidence, and impact. During this transition period, you may see references to both the company and dbt Labs throughout our recruiting process as we integrate our teams, systems, and career sites.

About the Role

The the company information security organization is a motivated and innovative team responsible for ensuring the continuous integrity, confidentiality, and availability of customers’ data. Our customers trust us with all their most sensitive information, and we consider maintaining that trust to be a critical, core component of our product and business.the company is seeking a motivated candidate for a GRC Senior Engineer of the Security Team. The role requires a compliance-focused engineer with knowledge and expertise in building data sets that will be used to turn our compliance into a continuous data-driven function. The position reports to the Director, GRC.Will build and own a security data lake that aggregates evidence and telemetry from across our environment, and use it to power continuous control monitoring (CCM) that replaces manual control testing with automation. You will also support core GRC operations, including internal and external audits, risk management, and vendor assessments.Acts as a subject matter expert within specific responsibility area(s) and applies internal audit best practices and keeps current with applicable rules and regulations for security compliance frameworks, as well as any authoritative pronouncements issued by relevant governing bodies. Advanced security risk or audit certifications are required and leading cybersecurity certifications are preferred.

This is a full-time position based out of ourOakland office. Our hybrid work model offers a blend of remote flexibility and in-person collaboration, including two days in the office each week to connect and build as a team.

Technologies You’ll Use

AWS, GCP, Azure, Kubernetes, Secureframe, Wiz, GitHub

What You’ll Do

• You will build and maintain a security data lake on the company itself, using our own platform to centralize the data that powers continuous control monitoring.

• Govern the lake itself: enforce data quality, retention, least-privilege access, and sensitive-data handling

• Build compliance-as-code: automated evidence collection, continuous control monitoring, and policy-as-code checks across cloud (AWS, GCP, Azure), Kubernetes, CI/CD pipelines, identity, and SaaS systems

• Integrate and extend GRC tooling and internal platforms with APIs, scripts, and workflows that replace manual audit work and give real-time visibility into control health

• Support the company's certifications and attestations: ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2, and HITRUST

Skills We’re Looking For

• 5+ years in GRC, security engineering, data engineering, or a related fieldUnderstanding and ability to perform control testing, documentation, and control design

• Strong SQL and proficiency in Python (or similar) for automation and data transformation

• Hands-on experience with a modern data stack (cloud warehouse/lake, ETL/ELT, orchestration, transformation tooling)

• Experience automating control testing or replacing manual compliance processes with code-driven checks

• Working knowledge of several of: ISO 27001 family, SOC 2, PCI DSS, HITRUST

• Familiarity with cloud security controls in [AWS / GCP / Azure] and common SaaS security configurations

• Ability to translate control language into technical tests, and technical results into audit-ready narratives

• Clear written communication and comfort working across Security, IT, Engineering, Legal, and Finance