Security Governance Engineer

Quick Facts

• Role: Sr. Security Governance Engineer

• Focus: security governance, control design, and policy ownership (not hands-on software development)

Description

Translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. Build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows, using governance-as-code approaches. Grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.

Responsibilities

• Develop and maintain security policies, technical standards, and control requirements, including policy lifecycle (versioning, approvals, exceptions, reviews, change management)

• Define structured, machine-readable policy/control requirements and partner with engineering to create guardrails and validation criteria (e.g., OPA/Rego or cloud-native policy frameworks)

• Maintain a common control framework with clear objectives, ownership, and validation criteria; ensure traceability from regulation to policy to control to implementation

• Set expectations for preventive, detective, and compensating controls and support continuous evaluation of control effectiveness

• Serve as SME/point of contact for assigned domains; interpret regulations, assess gaps/exceptions/emerging risks, and recommend improvements

• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams to bring governance into architecture and design

Benefits

• Engineering-first ways of working: version control, code review, CI/CD, backlogs; assurance work ships like software

• Automate first mindset: manual work that’s repeated is a candidate to be built

• Signals over surprises: gaps become alerts/workflows; control failures follow defined escalation paths

• Embedded partner approach: work alongside teams as peers, not gatekeepers

• Outcomes over activity: measure risk reduced, effort saved, and audit friction removed

• Room to grow: learn the engineering side if you come from GRC, or the risk side if you come from engineering

Requirements

• U.S. citizenship or Permanent Residency required (no visa sponsorship)

• 2+ years in information security governance, security engineering, technology risk, or related functions

• Strong grasp of security policies/standards and control frameworks/governance processes

• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS

• Ability to turn regulatory/security requirements into measurable control objectives

• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security

• Understanding of control design (preventive and detective), risk assessment, and exception management

• Familiarity with modern development practices, cloud environments, and CI/CD

• Strong analytical, communication, documentation, and stakeholder-management skills