GRC Engineer

Gainsight

9d • Remote

About The Position

Gainsight is seeking a full-time GRC Engineer to join its Security team. The role reports to the Director of Security and is remote in Mexico. The GRC Engineer will help maintain Gainsight’s governance, risk, and compliance program and keep the company audit-ready by maintaining control frameworks, supporting internal and external audits, assessing third-party risk, and automating evidence collection. The role works cross-functionally with Security, Engineering, IT, and Legal in a SaaS and cloud-based environment. Occasional travel of up to 10–25% may be required for team meetings, training, or company events. Responsibilities and scope may evolve with the needs of the team and business.

Requirements

• At least 5 years of experience in GRC, security compliance, IT audit, or risk management, ideally within a SaaS or cloud-based company.
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, and NIST, including mapping controls across frameworks.
• Experience supporting external audits and assessments, including scoping, evidence collection, walkthroughs, and tracking findings through remediation.
• Experience performing risk assessments, maintaining a risk register, and reviewing third-party vendor security posture.
• Familiarity with compliance automation or GRC tools and experience implementing security automation, such as scripting or workflow tools for recurring evidence collection and control monitoring.
• Understanding of cloud infrastructure and common security controls, including access management, logging, encryption, and change management, sufficient to evaluate evidence and discuss it with engineers.
• Clear written and verbal communication skills, including the ability to explain control requirements and risk to technical and non-technical teams.
• Ability to manage several deadlines at once.

Nice To Haves

• Experience with AI Governance frameworks.
• Previous experience in highly regulated industries requiring HIPAA or FedRamp.
• Experience working with globally distributed teams.
• Security certifications such as CISA, CRISC, or Security+.

Responsibilities

• Maintain multiple control frameworks and map controls to standards.
• Track control ownership and health, and meet with control owners to address control gaps.
• Scope internal and external audits and work with auditors from kickoff through completion.
• Collect and review evidence across frameworks to ensure compliance and traceability.
• Track audit findings and remediation items through completion.
• Perform security reviews of third parties and vendors, track vendor remediation items, and maintain the vendor inventory.
• Draft, update, and regularly maintain security policies, procedures, and standards.
• Answer customer security questionnaires and requests.
• Support customer audits and provide compliance documentation where required.
• Manage the risk register, including exceptions, acceptance, and expiry.
• Build and maintain integrations and automation for evidence collection and control monitoring.
• Work with engineering teams to align technical controls with business requirements.

Benefits

• Comprehensive benefits package, including medical, dental, vision, and other local statutory benefits administered through Remote.
• Corporate performance bonus.
• Christmas bonus (Aguinaldo) per local requirements.
• Mentoring and career development opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed