Senior GRC Engineer: AI-Powered Compliance Architect

Playlist

United States

On-site

USD 150,000 - 170,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Playlist is seeking a Senior GRC Engineer to own the technical spine of the control environment, designing architecture to manage multiple compliance frameworks with minimal duplication across audits.

You will lead the Master Control List and evidence lifecycle, drive automation in GRC tooling, and collaborate with Security, Legal, and Finance to translate compliance requirements into actionable engineering guidance. AI-powered workflows are a core focus.

Qualifications

6+ years of experience in security engineering, GRC, or compliance engineering, with direct hands-on work across multiple regulatory frameworks.
Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53.
Experience designing or maintaining control frameworks, crosswalks, or unified control architectures across multiple compliance standards.
Hands-on experience managing evidence requirements and control implementation, not just documentation.
Proficiency with compliance automation tooling (Optro, Drata, Vanta, Hyperproof, Anecdotes, or similar).
Ability to translate technical control design into clear implementation guidance for engineering and product teams.
Experience building or operating agentic AI workflows (LLM-based pipelines, multi-agent systems, RAG architectures) in a production or near-production context.
Nice to have: AWS services for compliance automation; external audits experience; multi-brand harmonization; certifications like CISA/CISSP/ISO 27001 Lead Implementer; SaaS/consumer marketplace experience

Responsibilities

Design and build framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, using OSCAL as translation layer.
Own the Master Control List end-to-end, including control nomenclature, relational database architecture, evidence linkages, and maintenance models.
Manage full lifecycle of controls, evidence requirements, and implementation as standards update or brands are acquired.
Drive evidence automation in GRC tooling, building collection workflows that scale across audits.
Partner with Security Engineering, Legal, and Finance to align control design with business operations and translate requirements for engineering teams.
Design, build and maintain AI-powered GRC tooling and multi-agent pipelines for risk quantification, evidence automation, vendor risk, and monitoring.
Identify rationalization opportunities across frameworks to minimize incremental work when adding a new standard