Security GRC Engineer: Risk, Audit & Compliance

Whatnot; Seattle (WA); On-site; USD 175,000 - 230,000; Full time

Benefits offered by this job

Health Insurance options including US

Work From Home support

Home office setup allowance

Monthly phone and internet allowance

Wellness and childcare allowances

401k with employer match up to 4%

Parental Leave

Dogfooding the app budget

Job summary

Whatnot's Security GRC team leads trust with regulators, customers, employees, and investors by implementing industry standards and continuous improvement. The role focuses on secure configurations, audit readiness, and risk prioritization across cloud-centric environments.

Ideal candidates have 5+ years in governance, risk, and compliance within tech startups. Bachelor's in CS/Info Sec and familiarity with ISO 27001, SOC2, PCI, GDPR/CCPA are required.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field.
• Deep knowledge of security best practices and industry standards (ISO 27001, SOC2, PCI, GDPR/CCPA).
• Experience supporting third party audit projects in cloud environments.
• Excellent written communication to document, communicate and report security assessments.

Responsibilities

• Reviewing and implementing secure configurations across tools (Okta, Terraform, AWS, Lumos, Cloudflare, GitHub).
• Developing security requirements for partner teams and driving execution.
• Preparing for and running external security audits.
• Shaping the strategic direction of the Security GRC team.
• Leading the security risk management program to prioritize risks and mitigations.

Skills

Security governance

Risk management

Compliance

Written communication

Cloud security

Education

Bachelor's degree in CS/Info Security

Job description

Whatnot's Security GRC team leads trust with regulators, customers, employees, and investors by implementing industry standards and continuous improvement. The role focuses on secure configurations, audit readiness, and risk prioritization across cloud-centric environments.

Ideal candidates have 5+ years in governance, risk, and compliance within tech startups. Bachelor's in CS/Info Sec and familiarity with ISO 27001, SOC2, PCI, GDPR/CCPA are required.