Senior Security Engineer - GRC

Classpass; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Classpass is seeking a senior Security/GRC engineer to build a shared control architecture across multiple brands. You will design and maintain mappings for PCI DSS, SOC 1/2, ISO 27001, HITRUST, and NIST frameworks and automate evidence collection.

You will own the master control catalog, manage evolving requirements, and collaborate with security, legal, finance, and product teams to translate controls into practical guidance.

Qualifications

• Six years in security engineering, GRC, or compliance engineering.
• Strong knowledge of PCI DSS, SOC 1/2, HITRUST, and ISO 27001 or NIST CSF/800-53.
• Experience designing or maintaining crosswalks or unified control architectures.
• Practical experience managing control implementation and evidence requirements.

Responsibilities

• Create and maintain mappings across PCI DSS, SOC 1/2, ISO 27001, HITRUST, and NIST CSF/800-53.
• Own the master control catalog, including data model and maintenance process.
• Manage control/evidence requirements as standards evolve or scope expands.
• Automate evidence collection and build AI-supported risk workflows.
• Collaborate with security engineering, legal, finance, and product teams to translate controls into guidance.
• Identify ways to reduce duplicated effort across frameworks and audits.

Skills

Security engineering

GRC

Compliance engineering

Cross-framework design

Automation platforms

AI workflows

Tools

AWS Lambda

Step Functions

EventBridge

S3

Aurora / RDS

Job description

Role overview

Build the technical foundation for governance, risk, and compliance across a multi-brand organization. You’ll design a shared control architecture that supports several security and audit frameworks, then keep its controls, evidence, and implementation current as standards change and the business grows.

Responsibilities

• Create and maintain mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, preserving each framework’s requirements while identifying reusable controls.


• Own the master control catalog, including its terminology, data model, evidence links, and maintenance process.


• Manage control and evidence requirements as new standards are adopted, requirements change, or additional business units enter scope.


• Automate evidence collection and build AI-supported workflows for risk analysis, vendor reviews, and compliance monitoring.


• Work with security engineering, legal, finance, and product teams to turn control designs into practical implementation guidance.


• Identify ways to reduce duplicated effort across frameworks and audits.

Requirements

• At least six years in security engineering, GRC, or compliance engineering, with hands‑on work across multiple frameworks.


• Strong knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53.


• Experience designing or maintaining crosswalks, control frameworks, or unified control architectures.


• Practical experience managing control implementation and evidence requirements, beyond writing documentation.


• Familiarity with compliance automation platforms and the ability to advise engineering and product teams on technical controls.


• Experience building or operating production or near‑production AI workflows, such as LLM pipelines, agent systems, or retrieval‑augmented generation.

Nice to have

• Experience using AWS services such as Lambda, Step Functions, EventBridge, S3, or Aurora/RDS to build compliance automation.


• Serving as a primary technical contact for external audits; experience with multi‑brand control harmonization.


• Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP, or PCI ISA.


• Experience in SaaS or consumer marketplace environments.