Principal GRC Engineer—AI-Driven Security & Risk

Palo Alto Networks, Inc.; California; On-site; USD 168,000 - 271,000; Full time

Job summary

Palo Alto Networks, Inc. is seeking a Principal InfoSec GRC Business Engineer to architect, execute, and mature global governance, risk, and compliance programs.

In this senior role, you will bridge security engineering, enterprise risk management, and business operations by designing global governance frameworks and scalable risk assessment methodologies. You will partner with key stakeholders to craft actionable security policies and standards.

Qualifications

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, MIS, or equivalent practical experience.
• Active certification in CISSP, CRISC, CISM, or CISA required.
• Deep knowledge of ISO 27001/2, NIST SP 800‑53, NIST CSF, SOC 2 Type II, PCI‑DSS, GDPR, and enterprise risk frameworks.
• Proven track record in risk management processes and executive reporting.
• Hands‑on experience building GRC requirements and partnering with automation teams.

Responsibilities

• Design and scale the global GRC vision to align security governance with enterprise goals and regulatory mandates.
• Partner with senior leaders across Information Security, Legal, and Product Engineering to align risk tolerance with business objectives.
• Lead drafting, maintenance, rollout, and annual review of information security policies, standards, procedures, and guidelines.
• Translate regulatory and security frameworks into actionable requirements.
• Architect and refine risk assessment methodologies for cloud, SaaS, and hybrid environments.
• Lead end‑to‑end technical security risk evaluations for critical applications, infrastructure, and processes.
• Design and manage executive‑level risk reporting to show risk posture and drive risk reduction.
• Lead implementation and continuous improvement of enterprise GRC platforms and risk tools.
• Design and implement test plans and policy‑as‑code for automated evidence collection and real‑time control testing.
• Redesign manual risk and compliance processes into scalable, automated workflows.

Skills

GRC governance

Risk assessment

Policy development

Stakeholder liaison

Cloud security

ISO/NIST frameworks

Regulatory compliance

Communication

Automation collaboration

Education

Bachelor's or Master’s degree

Cybersecurity

Management Information Systems

Tools

GRC platforms

Cloud platforms (AWS/Azure/GCP)

Policy-as-code

Job description

Palo Alto Networks, Inc. is seeking a Principal InfoSec GRC Business Engineer to architect, execute, and mature global governance, risk, and compliance programs.

In this senior role, you will bridge security engineering, enterprise risk management, and business operations by designing global governance frameworks and scalable risk assessment methodologies. You will partner with key stakeholders to craft actionable security policies and standards.