Sr. GRC Engineer

Pendo; Raleigh (NC); Hybrid; USD 133,000 - 160,000; Full time

Job summary

Pendo's Information Security team protects data and helps ensure our products are built with security and privacy by design. The Sr.

GRC Engineer leads complex compliance, risk, and incident-response work across SOC 2, ISO 27001/42001, PCI-DSS, GovRAMP, or FedRAMP, translating security risk into business terms and guiding security roadmap decisions. This role is based in our Raleigh office, with a hybrid model that includes in-office presence and collaboration with engineering, product, and IT

Qualifications

• 3–5 years of hands-on security experience with ownership of compliance programs or security operations.
• Deep working knowledge of SOC 2, ISO 27001, PCI-DSS, FedRAMP, GovRAMP, or NIST 800-series.
• Ability to independently own auditor relationships and manage end-to-end audit cycles.
• Experience leading incident response investigations from triage to post-incident actions.
• Ability to translate security risk into business-risk language for leadership decisions.
• Active use of AI tools to accelerate security workflows (evidence collection, policy drafting, regulatory research).
• Strong written and verbal communication tailored for engineering, auditors and leadership.

Responsibilities

• Use AI to accelerate audit evidence preparation, policy documentation, and control testing.
• Identify maturity gaps and translate them into prioritized roadmap recommendations.
• Own one or more regulatory programs end-to-end (SOC 2 Type II, ISO 27001, PCI-DSS, GovRAMP, or FedRAMP).
• Lead control design, evidence collection, auditor relationships, and remediation tracking.
• Conduct organizational risk assessments and present prioritised recommendations to leadership.
• Lead incident response for complex security events from investigation to resolution.

Skills

Security governance

Compliance programs

Incident response leadership

Translate risk to business

AI-driven security tools

Auditor management

Education

Security certification (CISA, CISSP, CISM, Security+)

Tools

Splunk

Elastic

CrowdStrike

SentinelOne

Vanta

Drata

Archer

Job description

Pendo's Information Security team protects the data entrusted to Pendo and helps ensure our products are built with security and privacy by design. The team spans Security Operations, Product Security, and Compliance and Risk. With a small team and broad scope, the work directly supports the security, resilience, and trust of Pendo's products and operations.

The Sr. GRC Engineer is an AI-first technical leader who helps drive the evolution of Pendo's governance, risk, and compliance program. This role independently leads complex compliance, risk, and incident-response work while identifying program maturity gaps, translating security risk into business terms, and contributing to security roadmap and investment decisions. Success means building durable controls and programs that reduce risk and operational friction, not simply completing audits.

This role is based in our Raleigh office.

What this looks like day-to-day

• AI-driven compliance and operations acceleration: Use AI to accelerate audit evidence preparation, policy documentation, control testing workflows, and regulatory research. Evaluate GRC platform automation capabilities and integrate AI tooling where it reduces manual overhead, then document and share effective approaches with the team.
• Security program strategy and roadmap: Identify maturity gaps across compliance and security operations and translate them into prioritized roadmap recommendations grounded in business risk. Contribute to security investment discussions, clarify tradeoffs between coverage, cost, and risk, and anticipate emerging regulatory requirements before they become audit findings.
• Compliance program ownership: Own one or more regulatory compliance programs end-to-end, including SOC 2 Type II, ISO 27001/42001, PCI-DSS, GovRAMP, or FedRAMP. Lead control design, evidence collection, auditor relationships, and remediation tracking to maintain effective and durable compliance programs.
• Risk assessment and prioritization: Conduct organizational risk assessments and present findings to leadership with clear prioritization and investment-level recommendations. Translate technical exposure into business-risk language that enables leaders to make informed decisions without requiring additional security interpretation.
• Incident response leadership: Lead incident response for complex, multi-system security events from investigation through resolution. Conduct root cause analysis, run post-incident reviews, and own resulting actions that turn incident findings into measurable program improvements.
• Cross-functional partnership: Work directly with engineering, product, and IT teams to deliver compliance requirements, validate implementations, and embed security into day-to-day operations. Translate compliance obligations into actionable technical requirements and influence how partner teams approach security as well as what they deliver.

Who You Are

Beyond the qualifications, we hire through a specific lens. These aren't buzzwords; they're the things we'll actually look for in how you talk about your work.

You're a builder, not a maintainer.

You're most energized when there isn't a clear path yet, and you get to define it. You don't wait for direction; you identify gaps, shape solutions, and drive them forward. At Pendo, great Sr. GRC Engineers don't just follow instructions; they operate as strategic advisors, influencing decisions, guiding stakeholders, and elevating how we work.

You're AI-curious - genuinely.

You're not using AI tools occasionally. You're rewiring how you work around them. You're faster, sharper, and more prolific because of it, and you bring that energy to everything — how you approach your work, how you prep, how you communicate, how you think. We want someone who sees AI as a multiplier, not a shortcut.

Must-haves

• 3 to 5 years of hands-on security experience with demonstrated ownership of compliance programs or security operations work, rather than participation alone.
• Deep working knowledge of at least two of the following frameworks: SOC 2, ISO 27001, PCI-DSS, FedRAMP, GovRAMP, or the NIST 800-series.
• Demonstrated ability to independently own auditor relationships and manage an audit cycle end-to-end, including responding directly to auditor questions.
• Experience leading incident response investigations from triage through root cause analysis and producing post-incident documentation that engineering teams can act on.
• Demonstrated ability to translate security risk into business-risk language that enables leaders to make investment and prioritization decisions.
• Active, demonstrated use of AI tools to accelerate security workflows such as evidence collection, policy drafting, regulatory research, or detection analysis.
• Strong written and verbal communication skills, with the ability to tailor recommendations effectively for engineering, auditor, and leadership audiences.

Nice-to-haves

• Experience with SIEM or EDR platforms such as Splunk, Elastic, CrowdStrike, or SentinelOne, including independently writing and tuning detection rules.
• GRC platform administration experience with tools such as Vanta, Drata, or Archer, including automation configuration and third-party integrations.
• Experience operationalizing threat intelligence or conducting threat hunting using MITRE ATT&CK.
• A security certification such as CISA, CISSP, CISM, Security+, or equivalent.
• Experience working in a SaaS company with concurrent multi-framework compliance obligations.

About Pendo

Pendo was founded in 2013 by former product managers, who combined their heads and hearts to build something they wanted but never had as product managers: a simple way to understand and attack what truly drives product success. Our mission is to improve society's experience with software. Come join one of the fastest-growing startups, supported by best-in-class institutions like Battery Ventures, Salesforce Ventures, Spark Capital and Meritech.

Pendo Core Values: Bias to Act, Hone Your Craft, The Team is Pendo, and Maniacal Focus.

Location: Pendo is a hybrid culture. In-office 3 days per week unless designated remote.

Compensation: The expected base salary range for this role to be performed in Raleigh, NC is $133,400 - $160,000.

Benefits: Highly competitive, employer-heavy coverage, including $0 premium options, strong 401(k) match, equity, and flexible time off.

EEOC: We are an equal opportunity employer and believe having diverse teams where everyone brings their whole self to Pendo is key to our success. We welcome all people of different backgrounds, experiences, abilities and perspectives.

Accessibility: Pendo is committed to working with, and providing access and reasonable accommodation to, applicants with mental and/or physical disabilities. If you think you may require an accommodation for any part of the recruitment process, please send a request to: [e-mail]. All requests for accommodations are treated discreetly and confidentially, as practical and permitted by law.