Security Compliance, GRC Engineer

Mistral AI; Paris (KY); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Healthcare coverage

Parental leave

Relocation support

Wellness programs

Meal allowances

Transportation allowances

Job summary

Mistral AI is seeking a GRC Engineer to lead governance, risk, and compliance efforts across cloud and on-prem environments. You will design automation for monitoring, testing, and reporting, and collaborate with IT, Security, Legal, and business units to enforce policies.

You will implement continuous compliance processes, integrate GRC with SIEM, IAM, and other tools, and drive evidence collection for internal and external audits. Proficiency in English is required, French a plus.

Qualifications

• 5+ years in Governance, Risk, and Compliance (GRC) roles.
• Hands-on experience with GRC tools.
• Deep knowledge of ISO 27001, SOC 2, NIST CSF, COBIT, GDPR, NIS2, or HIPAA.
• Proficiency in scripting and automation to streamline GRC processes.
• Strong IT control and risk assessment methodologies.

Responsibilities

• Automate GRC workflows to streamline compliance monitoring and control testing.
• Integrate GRC tools with SIEM, IAM, and ticketing systems for real-time monitoring.
• Develop dashboards to show compliance status, risk exposure, and control effectiveness.
• Automate risk assessments, including vulnerability scanning integration.
• Embed policy-as-code into cloud and on-prem environments for consistent enforcement.
• Automate third-party vendor risk assessments and escalation workflows.
• Support audit evidence collection and streamline audit preparation.

Skills

GRC expertise

Scripting

Automation

SIEM

IAM

Vulnerability management

Cloud security

Regulatory knowledge

Communications skills

Tools

SIEM systems

IAM tools

Vulnerability scanning tools

Job description

About Mistral Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems, across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms. We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited.

Role Summary

As a GRC Engineer , you will be at the heart of Mistral’s Governance, Risk, and Compliance (GRC) program. You will design, implement, and maintain the technical and operational frameworks that ensure our organization meets its regulatory, security, and risk management obligations. Your role will involve collaborating with cross-functional teams to automate compliance processes, monitor risks, and enforce governance policies. You will play a key role in ensuring that our systems, processes, and controls align with industry standards and regulatory requirements.

What you will do

• Automate GRC workflows : Design, develop, and deploy automation scripts and tools to streamline compliance monitoring, evidence collection, risk assessments, and control testing.
• Integrate GRC tools with existing systems : Build and maintain integrations between GRC platforms and other enterprise systems (e.g., SIEM, IAM, or ticketing tools) to enable real-time risk and compliance monitoring.
• Develop custom dashboards and reports : Create automated dashboards to provide real-time visibility into compliance status, risk exposure, and control effectiveness for stakeholders.
• Automate control testing and validation : Implement automated control testing for technical controls (e.g., access reviews, patch management, or configuration compliance) to reduce manual effort and improve accuracy.
• Enforce policy-as-code : Embed compliance and security policies directly into cloud and on-premise environments, ensuring consistent enforcement across systems.
• Automate risk assessments : Develop workflows to automate the identification and prioritization of risks, such as integrating vulnerability scanning tools with GRC platforms to flag high-risk assets automatically.
• Streamline audit evidence collection : Automate the gathering and organization of audit evidence (e.g., logs, configuration files, or access records) to support internal and external audits, reducing preparation time and minimizing errors.
• Implement continuous compliance monitoring : Set up automated alerts and triggers for non-compliance events (e.g., unauthorized access, misconfigurations, or policy violations)
• Automate third-party risk management : Build workflows to automate vendor risk assessments, including sending questionnaires, scoring responses, and escalating high-risk vendors for review.
• Enhance incident response with automation : Collaborate with Security teams to automate incident response processes, such as triggering remediation workflows for identified risks or compliance gaps.
• Maintain and optimize GRC tools : Continuously improve GRC platforms by automating routine tasks (e.g., user access reviews, control attestations) and enhancing their scalability and performance.

About you

• 5+ years in Governance, Risk, and Compliance (GRC), IT audit, cybersecurity, or a related field.
• Hands-on experience with GRC tools.
• Deep knowledge of compliance frameworks such as ISO 27001, SOC 2, NIST CSF, COBIT, or regulatory requirements like GDPR, NIS2, or HIPAA.
• Proficiency in scripting and automation to streamline GRC processes.
• Strong understanding of IT controls , risk assessment methodologies, and security best practices.
• Experience with SIEM, IAM, or vulnerability management tools .
• Familiarity with cloud security and compliance (e.g., AWS, Azure, or GCP security controls).
• Ability to analyze complex data, identify trends, and develop actionable insights.
• Creative and pragmatic approach to addressing GRC challenges.
• Rigor in managing documentation, controls, and compliance evidence.
• Ability to work effectively with cross-functional teams, including IT, Security, Legal, and Business units.
• Clear and concise written and verbal communication skills, with the ability to explain technical concepts to non-technical stakeholders and vice-versa Professional proficiency in English; French proficiency is a plus..
• Certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor/Implementer

What We Offer

We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks. For the most up-to-date details on benefits available in your location, please refer to our Benefits page .

Privacy Policy

Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy .