Senior Security Governance Engineer

Quick Facts

Sr. Security Governance Engineering role focused on replacing legacy GRC with a continuous, automated, engineering-integrated assurance model.

Description

Translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. Build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows, with evidence coming from pipelines. Over time, grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.

Responsibilities

• Develop and maintain security policies, technical standards, and control requirements, including policy lifecycle management (versioning, approvals, exceptions, reviews, and change management).
• Define machine-readable policy/control requirements using Governance-as-Code / Policy-as-Code and work with engineering to translate them into guardrails and validation criteria (review implementations for alignment with policy intent).
• Maintain a common control framework with clear objectives, ownership, and validation criteria; establish traceability from regulation to policy to control to implementation.
• Set expectations for preventive, detective, and compensating controls and support continuous evaluation of control effectiveness.
• Serve as SME and point of contact for assigned control family domains; interpret regulations, assess gaps/exceptions, and recommend improvements.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams on architecture and design.
• Ensure governance outputs are predictable and integrated into engineering workflow so security posture and evidence remain current.

Requirements

• U.S. Citizenship or Permanent Residency required; visa sponsorship not available
• 7+ years in information security governance, security engineering, technology risk, or related functions
• Strong grasp of security policies, standards, control frameworks, and governance processes
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS
• Ability to turn regulatory and security requirements into measurable control objectives
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security
• Understanding of control design (preventive and detective), risk assessment, and exception management
• Familiarity with modern development practices, cloud environments, and CI/CD
• Strong analytical, communication, documentation, and stakeholder-management skills

Benefits

• Time off programs
• Medical, dental, vision, mental health support
• Paid parental leave
• Life and disability insurance
• 401(k)
• Employee stock purchasing program