Security GRC Specialist: ISO 27001 & SOC 2 Leader

SAP Fioneer; United States; Hybrid; USD 110,000 - 170,000; Full time

Job summary

SAP Fioneer is seeking a Security GRC Specialist to strengthen and scale the security practices that support our products, operations, and customer commitments.

You will partner with Engineering, IAM, IT, Security Operations and other teams to embed security requirements, perform risk assessments, drive SOC 2 and ISO 27001 programs, and enable measurable, practical compliance across the organization.

Qualifications

• 5+ years of experience in information security, security compliance, risk management, audit, or related disciplines.
• Hands-on experience managing or supporting SOC 2 programs, including control design, evidence collection, audit coordination, and remediation tracking.
• Strong knowledge of security frameworks and control standards such as SOC 2 and ISO 27001.
• Ability to assess security risks, evaluate control effectiveness, and communicate recommendations to varied stakeholders.
• Experience working cross-functionally with engineering, infrastructure, product, and business teams.

Responsibilities

• Assist engineering teams to ensure security controls across cloud, SaaS, identity, infrastructure, and applications meet thresholds.
• Perform security risk assessments, control reviews, gap analyses, and remediation planning with teams.
• Drive SOC 2, ISO 27001, and related assurance activities including evidence readiness and audit support.
• Partner with Engineering, IAM, IT, Security Operations and others to embed security requirements into projects.
• Support customer-facing security activities including reviewing contracts and security inquiries.

Skills

Information security

Security frameworks

Risk management

Cross-functional

Tools

Governance tooling

Job description

SAP Fioneer is seeking a Security GRC Specialist to strengthen and scale the security practices that support our products, operations, and customer commitments.

You will partner with Engineering, IAM, IT, Security Operations and other teams to embed security requirements, perform risk assessments, drive SOC 2 and ISO 27001 programs, and enable measurable, practical compliance across the organization.