Senior AI-Driven GRC Leader

Pendo; Raleigh (NC); Hybrid; USD 133,000 - 160,000; Full time

Job summary

Pendo's Information Security team protects data and helps ensure our products are built with security and privacy by design. The Sr.

GRC Engineer leads complex compliance, risk, and incident-response work across SOC 2, ISO 27001/42001, PCI-DSS, GovRAMP, or FedRAMP, translating security risk into business terms and guiding security roadmap decisions. This role is based in our Raleigh office, with a hybrid model that includes in-office presence and collaboration with engineering, product, and IT

Qualifications

• 3–5 years of hands-on security experience with ownership of compliance programs or security operations.
• Deep working knowledge of SOC 2, ISO 27001, PCI-DSS, FedRAMP, GovRAMP, or NIST 800-series.
• Ability to independently own auditor relationships and manage end-to-end audit cycles.
• Experience leading incident response investigations from triage to post-incident actions.
• Ability to translate security risk into business-risk language for leadership decisions.
• Active use of AI tools to accelerate security workflows (evidence collection, policy drafting, regulatory research).
• Strong written and verbal communication tailored for engineering, auditors and leadership.

Responsibilities

• Use AI to accelerate audit evidence preparation, policy documentation, and control testing.
• Identify maturity gaps and translate them into prioritized roadmap recommendations.
• Own one or more regulatory programs end-to-end (SOC 2 Type II, ISO 27001, PCI-DSS, GovRAMP, or FedRAMP).
• Lead control design, evidence collection, auditor relationships, and remediation tracking.
• Conduct organizational risk assessments and present prioritised recommendations to leadership.
• Lead incident response for complex security events from investigation to resolution.

Skills

Security governance

Compliance programs

Incident response leadership

Translate risk to business

AI-driven security tools

Auditor management

Education

Security certification (CISA, CISSP, CISM, Security+)

Tools

Splunk

Elastic

CrowdStrike

SentinelOne

Vanta

Drata

Archer

Job description

Pendo's Information Security team protects data and helps ensure our products are built with security and privacy by design. The Sr.

GRC Engineer leads complex compliance, risk, and incident-response work across SOC 2, ISO 27001/42001, PCI-DSS, GovRAMP, or FedRAMP, translating security risk into business terms and guiding security roadmap decisions. This role is based in our Raleigh office, with a hybrid model that includes in-office presence and collaboration with engineering, product, and IT