Security GRC Lead (Governance Engineering)

Join our team as a Security GRC Lead (Governance Engineering). In this role, you will bridge the gap between security and compliance requirements and engineering implementation. You will partner closely with various stakeholders, evaluate control implementation, create an engineering feedback loop, and develop second-line oversight protocols. You will also assess risk in M&A, track the direction of compliance frameworks, drive change management and enablement, run control incident management, influence future control design, drive security champion engagement, and report to executive leadership. Success in this role means creating a strong connection between what Assurance requires and what Engineering can effectively implement.

• Establishing a strong connection between Assurance requirements and Engineering implementation, ensuring controls are technically relevant and requirements are easier for Engineering teams to consume.
• Identifying implementation challenges early, incorporating emerging security and regulatory expectations into the control environment before they become compliance gaps.
• Building strong relationships with technical stakeholders across Engineering, establishing a network of security/control champions to provide implementation feedback and promote requirements.

• Ability to work effectively with Engineering while also partnering with Legal, Compliance, Security, Risk, and business stakeholders
• Experience with independent control testing, assurance or audit practices, incident or root-cause analysis, or M&A due diligence is a plus
• Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP, or similar frameworks
• Experience translating security, risk, regulatory, or compliance requirements into technical implementation requirements
• Strong communication skills, with the ability to explain technical implementation details to governance teams and translate governance expectations into language Engineering teams can act on
• Ability to challenge existing requirements constructively and recommend improvements based on technical realities and risk
• Ability to understand complex systems, architectures, APIs, infrastructure, cloud environments, and software development processes
• Familiarity with emerging technology and regulatory areas such as AI security, AI governance, privacy, and evolving global technology regulations
• Strong technical background in security engineering, cloud security, product security, IAM, platform engineering, or security architecture
• U.S. Citizenship or Permanent Residency required. We're unable to provide visa sponsorship for this role