GRC Engineer

Wilson Sonsini•Palo Alto, CA

1d•$116,875 - $158,125

About The Position

The GRC Engineer is a mid-level, technical and analytical position that works under the direction of governance, risk, and compliance leadership and reports to the Manager of IT Risk Operations. The role supports the implementation and maintenance of security risk and compliance programs, including alignment to the NIST Cybersecurity Framework and related standards. It contributes to risk management, control mapping, assessments, reporting, and remediation activities. The position analyzes information from IT systems and security tools to identify and report risks, collaborates with security operations and incident response teams, supports third-party risk reviews and client assurance requests, and administers cybersecurity awareness training. The role requires a self-directed professional committed to applying industry best practices in governance, risk, and compliance.

Requirements

At least 3 years of experience in security risk, governance, and compliance; security operations or incident response experience with demonstrated GRC exposure may be considered.
Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, and SP 800-39, including understanding of the cybersecurity risk assessment process.
Working knowledge of IT fundamentals, including networking, identity and access management such as Active Directory, and cloud security such as Microsoft Azure.
Excellent written and verbal communication skills, including the ability to explain risk to technical and non-technical audiences.
Strong organizational, interpersonal, and critical-thinking skills; ability to manage multiple priorities under pressure, work independently, and collaborate with diverse teams.
Sound judgment, high ethical standards, and discretion in handling confidential client information.
Ability to respond promptly to unplanned requests within agreed service-level expectations and accurately estimate project time and resources.
Commitment to continuous learning of new technologies, frameworks, and skills.
Associate’s or Bachelor’s degree in information security, information technology, risk management, or a related field, or an equivalent combination of education, certification, and experience.

Nice To Haves

Relevant certifications such as CompTIA Security+, CISA, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, Microsoft SC-200, or AZ-500.
Law firm experience, including responding to client security questionnaires and reviewing outside counsel guidelines.
Experience with a GRC platform such as ServiceNow or RSA Archer, and with SIEM, vulnerability, or threat management tools such as Microsoft Sentinel or Splunk.
Scripting or automation experience, such as Python, PowerShell, or KQL, to streamline recurring GRC reporting and data gathering.
Working knowledge of Claude, Legora, BitSight, and/or Prompt Armor.

Responsibilities

Contribute to implementation and maintenance of the NIST Cybersecurity Framework program, track progress against current and target profiles, and support assessments against standards such as ISO/IEC 27001, CIS Controls, and SOC 2.
Map existing security controls to NIST requirements and other applicable frameworks, perform gap analyses and self-assessments, and identify gaps for remediation.
Support delivery of security risk and compliance standards and maintain related documentation.
Maintain security risks in the Risk Register, coordinate with teams to obtain status, and provide remediation insights.
Contribute to the ServiceNow implementation, including requirements, testing, and workflow input.
Identify critical and high-risk systems and processes and document their risk profiles.
Resolve governance, risk, and compliance team tickets and track them to closure.
Prepare and deliver periodic risk, compliance, and service-level metrics and reports tailored to leadership and stakeholder audiences.
Gather and analyze data from IT systems and security tooling, including SIEM and log sources, unauthorized access attempts, and phishing reports, and create detailed reports.
Use threat, vulnerability, endpoint, and cloud security management systems and tools to identify high-risk systems, create threat analysis reports, initiate follow-up actions, and help reduce risk.
Partner with security operations and incident response teams to translate incident and vulnerability trends into risk register entries and remediation recommendations, and maintain related standard operating procedures.
Analyze policies, systems, hardware, software, cloud, and network infrastructure and recommend risk-reduction methods and strategies.
Administer the cybersecurity awareness training program, including assigning courses, tracking completion, and reporting results.
Conduct third-party risk management analysis, including reviewing vendor security documentation and recording results.
Complete security questionnaires and provide supporting documentation within agreed turnaround times.
Perform other related duties as assigned by governance, risk, and compliance leadership.