Security GRC Engineer - Automate Compliance & Trust

Socket.dev; San Francisco (CA); On-site; USD 180,000 - 230,000; Full time

Job summary

Socket.dev is seeking a Security GRC Engineer in San Francisco to automate compliance workflows and scale our governance, risk, and compliance program. You will lead evidence gathering, drive continuous control testing, and coordinate with auditors and customers to uphold high security standards.

You will collaborate with Engineering, Legal, GTM, Trust & Safety, and regulators to implement and audit SOC 2, ISO 27001, ISO 42001, and AIUC-1 controls across products and infrastructure.

Qualifications

• Experience with GRC frameworks such as SOC 2, ISO 27001, ISO 42001, and AIUC-1.
• Ability to trace external claims to how the product and infrastructure are configured using coding agents.
• Strong cross-functional collaboration with Engineering, Legal, GTM, Trust & Safety, auditors, and regulators.

Responsibilities

• Automate evidence gathering and continuous control testing.
• Own the relationship with audit firms and customers—explain the security and AI governance program and earn their trust.
• Conduct security compliance reviews for new products, features, and vendors.
• Support Legal in contract negotiations with timely, accurate guidance on security and AI governance terms.
• Support incident response communications—draft and review customer-facing updates during security incidents.
• Build self-serve documentation and tools to answer customer security and AI governance inquiries.
• Maintain corporate security policies.

Skills

GRC frameworks

Audit liaison

Security governance

Job description

Socket.dev is seeking a Security GRC Engineer in San Francisco to automate compliance workflows and scale our governance, risk, and compliance program. You will lead evidence gathering, drive continuous control testing, and coordinate with auditors and customers to uphold high security standards.

You will collaborate with Engineering, Legal, GTM, Trust & Safety, and regulators to implement and audit SOC 2, ISO 27001, ISO 42001, and AIUC-1 controls across products and infrastructure.