Senior GRC Engineer

A-LIGN Compliance and Security, Inc.; United States; Teletrabalho; USD 140 000 - 190 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Healthcare, Dental, and VisionBenefits

Employer Paid Life Insurance and Disab

EAP - Employee Assistance Program

401(k) Plan with Employer Matching

Competitive Bonus Structure

Home Office Reimbursement

Certification Reimbursement

Personalized Career Coaching

Generous Paid Time Off

Paid Office Closure December 25-Januay

Resumo da oferta

A-LIGN Compliance and Security, Inc. is seeking a Senior GRC Engineer to own audit evidence collection and maintain controls across FedRAMP, ISO, SOC, and NIST frameworks.

You will work hands-on in GCP, GitHub, and Microsoft 365/Entra ID, coordinating with IT/DevOps to reduce audit burden while protecting certifications for clients and platforms.

Qualificações

• 5+ years of experience in information security, GRC, IT audit, or compliance engineering.
• Experience with FedRAMP, GovRAMP, NIST 800-53, or NIST 800-171.
• ISO 27001, ISO 42001, or SOC 2 experience preferred.
• Audit evidence collection and automation tooling experience.
• Vulnerability management, CI/CD, IaC, and IAM concepts familiarity.
• Proficient in scripting for evidence collection (Python/PowerShell).
• Familiarity with risk assessment methodologies and threat modeling.

Responsabilidades

• Own end-to-end audit evidence collection, validation, and organization across multiple frameworks.
• Maintain and verify technical controls across cloud and corporate environments (GCP, GitHub, M365/Entra ID).
• Serve as liaison between GRC and IT/Engineering/DevOps to reduce audit burden.
• Support FedRAMP continuous monitoring, including KSI evidence and 3PAO requests.
• Build evidence automation interfacing GRC tools with identity providers and cloud platforms.
• Support ISO 42001 AI management system evidence and nonconformity remediation tracking.
• It's to coordinate with external assessors during assessment windows.
• Monitor control health between audit cycles and drive remediation with owners.
• Maintain control narratives, policies, and procedures; support supplier security reviews.

Conhecimentos

GRC

Audit evidence collection

Cross-functional collaboration

Python scripting

Threat modeling

Risk assessments

Documentation

Formação académica

Bachelor's degree in information systems, cybersecurity, business, or equivalent

Ferramentas

GCP

GitHub

Microsoft 365/Entra ID

Descrição da oferta de emprego

About the Role

The Senior GRC Engineer owns audit evidence collection and technical control maintenance across A-LIGN's growing portfolio of compliance frameworks, including FedRAMP Moderate Equivalency, FedRAMP 20x, ISO 27001, ISO 42001, and SOC 2. This role bridges the GRC function and A-LIGN's technical teams, working hands-on in GCP, GitHub, and Microsoft 365 to collect evidence, verify controls, and keep A-LIGN continuously audit-ready. The Senior GRC Engineer works cross-functionally with every technical department in the company to reduce audit burden on engineering and IT while protecting the certifications that A-LIGN's clients and platforms depend on. The role also supports broader information security activities, including risk assessments, threat modeling, security reviews, and AI technical safeguards. Reports to Chief Information Security Officer

Pay Classification Full-Time, Exempt

Responsibilities

• Own end-to-end audit evidence collection, validation, and organization across A-LIGN's compliance frameworks, including FedRAMP (Moderate Equivalency and FedRAMP 20x), ISO 27001, ISO 42001, SOC 2, NIST 800-53, and NIST 800-171
• Maintain and continuously verify technical controls across A-LIGN's cloud and corporate environments, including Google Cloud Platform (GCP/GKE), GitHub, and Microsoft 365/Entra ID
• Serve as the primary liaison between the GRC function and technical departments (IT, Engineering, DevOps) to gather evidence, validate control implementation, and reduce audit burden on those teams
• Support FedRAMP continuous monitoring activities, including Key Security Indicator (KSI) evidence, vulnerability scan artifact collection, POA&M tracking, and assessor (3PAO) requests
• Build and maintain evidence automation, including integrations between GRC tooling and source systems (identity provider, cloud platforms, code repositories, ticketing, endpoint management) to reduce manual collection effort
• Support A-LIGN's ISO 42001 Artificial Intelligence Management System (AIMS), including AI risk register evidence, AI control monitoring, and nonconformity remediation tracking
• Prepare audit-ready evidence packages and coordinate directly with external assessors and certification bodies during assessment windows
• Monitor control health between audit cycles, identify control drift or failures, and drive remediation with control owners before findings occur
• Maintain compliance documentation, including control narratives, policies, and procedures
• Support supplier and vendor security reviews with framework-specific evidence requirements
• Track framework changes (FedRAMP 20x requirements, ISO standard revisions, SOC 2 criteria updates) and translate them into actionable control and evidence updates
• Conduct security risk assessments and contribute to A-LIGN's corporate risk management program and risk register
• Participate in threat modeling for A-SCEND features, internal systems, and AI use cases, and translate findings into control improvements
• Perform security reviews of new tools, vendors, and internal initiatives, including support for Vendor Review Board activities
• Implement and validate AI technical controls and safeguards, including data loss prevention, AI connector and agent governance, and acceptable use enforcement, in support of A-LIGN's AI Management System
• Report compliance posture, evidence status, and audit readiness metrics to the CISO and GRC leadership

Minimum Qualifications

Education

Bachelor's degree in information systems, cybersecurity, business, or equivalent combination of education and experience

Experience

5+ years of experience in information security, GRC, IT audit, or compliance engineering roles Hands-on experience with audit evidence collection and technical control validation for at least one of the following required: FedRAMP, GovRAMP, NIST 800-53, or NIST 800-171 Additional experience with ISO 27001, ISO 42001, or SOC 2 preferred but not required DevSecOps or cloud engineering experience sufficient to independently locate and extract evidence from GCP, GitHub, and Microsoft 365/Entra ID environments Experience with GRC platforms and evidence automation (AuditBoard, Vanta, Drata, or similar) Experience supporting external audits and assessor interactions, including 3PAO assessments Working knowledge of vulnerability management, CI/CD pipelines, infrastructure-as-code, and identity and access management concepts Experience scripting or automating evidence collection (Python, PowerShell, or similar) preferred Familiarity with risk assessment methodologies, threat modeling (e.g., STRIDE), and security review processes preferred

Certifications

CISA, CISSP, CCSK/CCSP, ISO Lead Auditor/Implementer, or relevant certifications preferred but not required

Skills

Strong cross-functional collaboration and project management skills Ability to translate framework requirements into clear, actionable requests for technical teams Highly organized with the ability to manage evidence deadlines across multiple concurrent audit cycles Excellent written communication for control narratives, evidence descriptions, and assessor responses Self-directed with strong follow-through in a fast-paced, deadline-driven environment Proven experience utilizing AI tools to automate manual tasks, streamline workflows, and increase team efficiency Experience operating in PE-backed or high-growth environments preferred

Benefits

• Healthcare, Dental, and Vision Benefits
• Employer Paid Life Insurance and Disability Insurance
• EAP - Employee Assistance Program
• Pet Insurance
• 401(k) Plan with Employer Matching
• Competitive Bonus Structure
• Home Office Reimbursement
• Certification Reimbursement
• Personalized Career Coaching
• Generous Paid Time Off
• Paid Office Closure December 25-January 1
• Vacation Bonus
• Summer Hours

About A-LIGN

A-LIGN is the leading provider of high-quality, efficient cybersecurity compliance programs. Combining experienced auditors and audit management technology, A-LIGN provides the widest breadth and depth of services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. A-LIGN is the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor. To learn more, visit a-lign.com.

About Us

A-LIGN is a leading provider of high-quality, efficient cybersecurity compliance programs. We help global organizations take a strategic approach to mitigating risk. By combining the expertise of our people with a powerful technology platform, we help our clients protect against future threats and build lasting customer confidence. As a top-tier global assessor, we provide the people, process, and technology necessary for organizations to navigate the complexities of the modern security landscape.

The A-LIGN Difference

We believe our mission starts with an investment in our people. We provide opportunities to elevate their careers and reach full potential. Our culture is defined by a commitment to continuous growth supported by our core values: Innovate Constantly, Commit to Quality, Do the Right Thing Always, and Be All in. We empower our team members with: - Personalized career coaching and leadership opportunities designed to support professional development - Generous PTO plan, shortened summer hours, and annual paid office closure from December 25 to January 1 - Competitive compensation plans and certification reimbursement - Additional financial incentives such as comprehensive health insurance plans, home office reimbursement, and more

A-LIGN is an Equal Opportunity Employer. Minorities, women, disabled, and veterans encouraged to apply!