Senior GRC Engineer: Automate SOC 2 & Compliance

Clerk; United States; Remote; USD 140,000 - 230,000; Full time

Benefits offered by this job

Competitive Salary

Equity Ownership

Health Coverage

Home office gear

Flexible vacation policy

Diverse team

Job summary

Clerk is seeking a Senior GRC Engineer to join our Security Team. You will own the program that makes vendor reviews easy: controls, evidence, audits, and the answers, with hands-on work building integrations and internal tools to enforce policies and automate evidence gathering.

You will drive end-to-end SOC 2 Type II and HIPAA coverage, help scope an ISO 27001 framework, and feed our GRC platform from cloud providers and SaaS tools.

Qualifications

• 5+ years in security, with demonstrated experience building automation for a GRC or compliance program
• You've been the technical owner of at least one SOC 2 Type II or ISO 27001 audit and can tell us what you would do differently
• You write code, and you use LLMs to get more done without lowering the bar
• Hands-on with a GRC platform's API, not just its dashboard
• Cloud IAM and configuration depth on at least one provider, GCP preferred
• You can decide what evidence is sufficient and defend an automated test to an auditor
• Comfortable being one of a few security engineers; you can scope, prioritize, and ship without a lot of process around you
• Clear writer: policies, control narratives, and questionnaire answers are read by customers, so they have to be good

Responsibilities

• Own SOC 2 Type II and HIPAA end to end: scoping, control design, evidence, auditor walkthroughs, and remediation
• Scope and lead our next framework (ISO 27001 is the likely candidate) based on what customers actually ask for
• Build and maintain the integrations that feed our GRC platform from our cloud providers, SaaS tools, and internal systems
• Turn controls into continuous checks: policy-as-code, config drift detection, and a control-failure pipeline from detection to closure
• Run the vendor security review program, from intake to periodic re-review
• Own the security questionnaire and trust center workflow
• Maintain the risk register and run risk assessments that produce documented decisions
• Embed compliance requirements into the SDLC and change management so they're enforced by tooling, not by reminders
• Reduce the number of things a human has to do to pass an audit every quarter

Skills

Automation for GRC

SOC 2 / ISO 27001 ownership

Code in production

LLM-assisted tooling

Cloud IAM (GCP preferred)

Tools

GRC platform API

Cloud IAM

ISO 27001 tooling

Job description

Clerk is seeking a Senior GRC Engineer to join our Security Team. You will own the program that makes vendor reviews easy: controls, evidence, audits, and the answers, with hands-on work building integrations and internal tools to enforce policies and automate evidence gathering.

You will drive end-to-end SOC 2 Type II and HIPAA coverage, help scope an ISO 27001 framework, and feed our GRC platform from cloud providers and SaaS tools.