Security Governance (GRC) Lead

Quick Facts

• Role: Security GRC Lead (Forward Deployed Assurance)

• Focus: Bridge Security & Compliance requirements and Engineering implementation

Description

You will serve as a technical voice for Assurance, translating security and compliance expectations into technical requirements Engineering teams can implement and validate. You will evaluate how controls are designed, implemented, operated, and scaled across enterprise systems, and build feedback loops and second-line oversight to improve control reliability. You will also assess risk during M&A, influence future control design, and report control reliability, coverage, pressure, and systemic risk trends to executive leadership.

Responsibilities

• Act as a technical liaison between Assurance, Engineering, Product Security, PCLs, Legal, and other stakeholders to ensure governance requirements are feasible and implementable

• Evaluate control implementation across applications, platforms, infrastructure, cloud environments, and engineering workflows

• Identify where controls or requirements create friction and feed insights back into control standards and governance processes

• Translate regulatory and security expectations into clear, actionable technical requirements

• Develop second-line oversight protocols (e.g., attestations and CRE checks) to monitor and validate controls are operational

• Understand systems end-to-end to improve Assurance risk and compliance decisions

• Assess control and risk exposure during M&A and design an executable activation plan tied to the risk model

• Partner on emerging requirements (including AI governance and privacy) to translate them into future security controls and engineering expectations

• Track how regulatory/compliance frameworks are evolving (e.g., EU AI Act and other international requirements) and identify organizational implications

• Drive change management and enablement so teams know what applies and how to comply

• Stand up control incident management with postmortems, root-cause analysis, and control error budgets

• Influence future control design based on new technologies, regulatory expectations, architecture changes, and lessons learned

• Engage “security champions” across Engineering to scale governance feedback and implementation

• Report systemic risk and control reliability trends to executive leadership

• Represent Assurance in architecture, engineering, security, and governance discussions early in the process

Requirements

• U.S. Citizenship or Permanent Residency required; visa sponsorship cannot be provided

• 5–6 years of relevant experience in security engineering, cloud security, product security, IAM, platform engineering, IT governance, or similar technical background

• Strong ability to understand complex systems, architectures, APIs, infrastructure, cloud environments, and software development processes

• Experience translating security/risk/regulatory/compliance requirements into technical implementation requirements

• Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP, or similar

• Familiarity with AI security, AI governance, privacy, and evolving global technology regulations

• Ability to collaborate effectively with Engineering and partner with Legal, Compliance, Security, Risk, and business stakeholders

• Strong communication skills to translate governance requirements into engineering-actionable language

• Ability to challenge requirements constructively and recommend improvements based on technical realities and risk

• Plus: experience with independent control testing/assurance/audit, incident or root-cause analysis, or M&A due diligence

Benefits

• Comprehensive benefits including time off, medical, dental, vision, and mental health support

• Paid parental leave

• Life and disability insurance, 401(k), and an employee stock purchasing program