Security Engineer - GRC Frameworks & AI Governance

Cybersecurity Jobs; Palo Alto (CA); On-site; USD 100,000 - 198,000; Full time

Benefits offered by this job

Equity

Medical, Vision, Dental

401(k)

Disability insurance

Life insurance

Employee discounts

Job summary

Cybersecurity Jobs in Palo Alto is seeking a security compliance professional to support enterprise security and AI governance by building controls, automating evidence, and keeping systems audit-ready across frameworks.

You will partner with engineering, manage audits with external regulators, and advance Compliance-as-Code, policy-as-code, and continuous monitoring within CI/CD workflows.

Qualifications

• Bachelors degree in computer science, information security, cybersecurity or related field.
• 3+ years of experience in GRC, security compliance, or technology audit with hands-on GRC engineering responsibilities.
• Experience implementing security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert working knowledge of several frameworks: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, including controls.

Responsibilities

• Plan and deliver security compliance implementations and audits across SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and EU AI Act.
• Develop and maintain Compliance-as-Code and policy-as-code with automated validation and evidence pipelines.
• Operate and extend GRC platforms (e.g., Vanta) as the system of record for controls and evidence.
• Partner with engineering to embed compliance requirements early in design reviews and translate obligations into technical controls.
• Create and maintain corporate policies, standards, and procedures supporting governance and AI management posture.
• Identify and prioritize risks across AI/ML, cybersecurity, data privacy, and cloud deployments; separate business risk from compliance theater.
• Lead risk assessments and compliance reviews for new products and architectural changes, focusing on AI system risks.
• Build relationships with external auditors and regulators; ensure requests are reasonable and relevant.
• Promote a security and compliance culture by educating teams on control purpose and rationale.

Skills

GRC engineering

Security compliance

Technology audit

CI/CD integration

IAM

Education

Bachelor’s degree in CS/Info Security/Engineering

Tools

Vanta

Drata

Job description

Support enterprise security and AI governance by building compliance controls, automating evidence, and keeping systems audit-ready across core frameworks.

Responsibilities

• Plan and deliver security compliance implementation and audits across SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act; include control design, framework mapping, gap assessments, evidence collection, and remediation tracking.
• Develop and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, continuous evidence pipelines, and monitoring integrated into development and deployment workflows.
• Operate and extend GRC platforms (e.g., Vanta) as a system of record for controls, evidence, and audit readiness; integrate with cloud, identity, and engineering tooling to reduce manual effort.
• Partner with engineering and architecture to embed compliance requirements early in design reviews and translate framework obligations into technical control narratives aligned to auditor expectations and internal delivery timelines.
• Create, maintain, and continuously improve corporate policies, standards, and procedures supporting governance and AI management system posture.
• Identify, assess, and prioritize risks spanning AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments; separate meaningful business risk from compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with focus on AI system risks including data handling, model governance, and agentic and conversational surfaces.
• Build and manage relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; act as the liaison between auditors and internal teams to ensure requests are reasonable, clear, and relevant to the stack.
• Promote a security and compliance culture by educating teams on control purpose and operational rationale, not only enforcement.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or engineering/STEM field.
• 3+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Proven experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert working knowledge of several of: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, including building and running controls.
• Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, Drata, or similar), with a focus on continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and to collaborate with engineers on remediation.

Technologies

• SOC 2
• NIST CSF
• NIST SP 800-53
• ISO 27001
• ISO 42001
• EU AI Act
• Compliance-as-Code
• Policy-as-code
• Vanta
• Drata
• AWS
• GCP
• Azure
• GRC platforms
• CI/CD
• Cloud

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

Compensation

• $100,000 - $198,000 USD base salary
• Total rewards package includes equity, comprehensive medical/vision/dental, 401(k), disability insurance, life insurance, and various other discounts and perks

Preferred Skills and Experience

• 5+ years of security compliance, GRC engineering, or technology audit-related experience.
• Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
• Experience in the tech or AI/ML industry, particularly with startups or high-growth product organizations.
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, especially in a publicly traded or IPO-bound company.
• Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act) and associated operational risks.
• Working knowledge of data privacy frameworks (e.g., GDPR, CCPA) in a technology or cloud environment.
• Exceptional analytical, problem-solving, organizational, and project management skills, with ability to take compliance programs from conception to audit-ready launch.
• Excellent communication and stakeholder management skills to explain risk and tradeoffs to engineers, legal, sales, and executives in plain language.
• Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar preferred.
• Experience with public sector or federal compliance programs (e.g., FedRAMP, NIST 800-171, CMMC) is a plus.

ITAR Requirements

• To conform to U.S. Government export regulations, applicant must be: (i) a U.S. citizen or national, (ii) a U.S. lawful, permanent resident (green card holder), (iii) a Refugee under 8 U.S.C. § 1157, or (iv) an Asylee under 8 U.S.C. § 1158, or eligible to obtain required authorizations from the U.S. Department of State.