Senior Security Engineer GRC Engineering
One Identity
IndiaremotePosted 16 days ago
Skill Required
Security-EngineerGRC-EngineerCompliance-EngineerCybersecurity-EngineerInformation-Security-EngineerGRC-Security-EngineerSenior-Security-GRC-AnalystSenior-Cybersecurity-EngineerSenior-Information-Security-EngineerSenior-GRC-Automation-EngineerSecurity EngineerEngineeringsecurityISO 27001automationObservabilityITILbuildingPythondesignAzureCloudjQueryRustAWSandAIFulltime
Key highlights
- Salary: Not stated.
- Required experience: 6+ years in compliance/security engineering.
- Focus: Modernizing GRC through automation and code.
- Key framework base: ISO 27001 and SOC 2.
- Technical requirement: Recent hands-on Python and AI-in-the-loop experience.
Role overview
The Senior Security Engineer for GRC Engineering will lead the company's compliance engineering program as it transitions into an independent security function. This role focuses on modernizing GRC by building a centralized common controls framework and automated evidence systems that interface with cloud control planes, build pipelines, and identity systems to support international regulatory requirements.
Responsibilities
- Own continuous control monitoring end-to-end, including integrations into identity providers, cloud control planes, code repositories, endpoint management, and ticketing.
- Build a centralized common controls framework and artifact layer based on ISO 27001 and SOC 2, ensuring evidence is captured, timestamped, and indexed.
- Ensure the evidence system operates within the controls it measures and maintains its own audit trail.
- Write control validation as code to programmatically test control implementation, with outputs accepted by auditors and actionable by engineers.
- Partner with the principal infrastructure seat on policy as code to ensure enforced policies emit required framework evidence.
- Determine the application of agentic workflows in compliance engineering, including control mapping, evidence classification, and first-pass validation.
- Own the program's direction, including framework selection, automation prioritization, and engineering effort allocation.
- Advance program metrics such as control health, coverage, and remediation velocity.
- Integrate cyber risk management into the platform, including risk registers and exception handling.
- Maintain asset prioritization as the base layer of the program to inform risk decisions and control coverage.
- Front the technical side of audits by explaining control implementation and evidence production to assessors.
Requirements
- Six or more years across compliance program leadership and security or compliance engineering, with experience in both the framework and build sides.
- Depth in at least one of the following: a major framework assessment (e.g., FedRAMP) from readiness to certification, or end-to-end GRC engineering ownership.
- Experience in strategic framework design, including control mapping across frameworks.
- Recent hands-on engineering experience with Python, API integration, and building with AI in the loop within the last six months.
Nice to have
- Framework fluency across ISO 27001, SOC 2, FedRAMP 20x, NIS2, DORA, and PCI DSS.
- Familiarity with policy-as-code frameworks and enforcement architecture.
- Azure and AWS cloud depth regarding evidence location.
- Experience with compliance automation platforms.
- Experience running an audit calendar and managing assessor relationships.
- Technical writing skills suitable for both auditors and engineers.
- Prior experience on the assessor's side of the table.
- Experience with IRAP or international regimes outside the US.
- Evidence work across hosted services and customer-deployed software.
- Prior time as a software or platform engineer.
Benefits
- Commitment to team members' health and wellness.
- Programs to enable team members to pursue a career that fulfills their potential.
- Enhanced career opportunities to learn and grow in a rapidly changing environment.
- Opportunities to build and develop products at scale.
Additional details
- Role: Senior Security Engineer GRC Engineering.
- Department: Information Security, Customer Trust & Assurance.
- Level: Senior individual contributor.
- Location: India.
- Reports to: Director of Information Security.
- The team is lean and globally distributed.
- One Identity is an Equal Opportunity Employer.
- Official communication only via @oneidentity.com email addresses; no Telegram or text messaging used for recruiting.