GRC Engineer

Seven AI • Boston, MA

1d • $130,000 - $180,000

About The Position

As 7AI’s GRC Engineer, you will keep the company audit-ready and make security assurance straightforward for customers. You will manage the compliance program day to day, work directly with customers and vendors on security questions, and keep internal teams informed about the status of initiatives. The role includes maintaining controls, evidence, and integrations through a compliance automation platform; preparing for audits and assessments; conducting internal audits and control testing; managing third-party risk; and keeping policies and risk records current as the business and applicable frameworks change. You will also use AI to automate repeatable GRC work.

Requirements

• 5+ years of experience in GRC, compliance, or security risk.
• Hands-on experience supporting SOC 2 audits and working knowledge of ISO 27001, ISO 42001, and FedRAMP.
• Experience managing third-party risk, including vendor assessments.
• Experience with a compliance automation platform such as Scytale, Vanta, or Drata.
• Experience conducting internal audits or control testing.
• Comfort communicating with customers and vendors about security in plain language.
• Strong project-tracking habits and a track record of keeping stakeholders informed.
• Practical experience using AI tools to speed up work, and curiosity about further automation.
• A proactive, hands-on mindset and ability to identify and initiate needed work.

Nice To Haves

• Bachelor’s or master’s degree.
• Hands-on experience with SaaS compliance automation platforms.
• Experience at a security vendor or fast-growing startup, especially in customer-facing security assurance.
• Exposure to AI governance, such as ISO 42001 or the NIST AI RMF.
• Scripting skills, such as Python or SQL, for automating evidence collection and reporting.
• Certifications such as CISA, CRISC, CISSP, or ISO 27001 Lead Auditor or Lead Implementer.

Responsibilities

• Manage and maintain the compliance program through a compliance automation platform, keeping controls, evidence, and integrations current.
• Prepare for and support SOC 2, ISO, and FedRAMP audits, as well as assessments for other regulatory frameworks required by the business and customers.
• Conduct internal audits, test controls, document findings, and track remediation through closure.
• Manage third-party risk, including assessing vendors, reviewing security documentation, and maintaining the vendor risk register.
• Work with customers on security questionnaires, compliance documentation, and assurance requests.
• Work with vendors to collect evidence and close gaps.
• Keep internal stakeholders informed on GRC projects and initiatives, with clear status tracking from start to finish.
• Use AI to automate repeatable GRC work, such as evidence collection, questionnaire responses, and control testing.
• Keep policies, control descriptions, and risk records accurate as frameworks and the business change.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed