GRC Engineer

Wilson Sonsini Goodrich & Rosati•Palo Alto, CA

3d•$116,875 - $158,125

About The Position

The GRC Engineer is a mid-level technical and analytical position working under the direction of governance, risk, and compliance leadership and reporting to the Manager of IT Risk Operations. The role applies industry best practices to support the client’s governance, risk, and compliance programs, including the NIST Cybersecurity Framework (CSF), security risk management, compliance activities, and related documentation. The engineer supports framework alignment and control mapping; maintains risk-register records and related metrics; contributes to GRC tooling implementation; and analyzes threats, vulnerabilities, and security trends to recommend risk-reduction actions. The position also administers cybersecurity awareness training, conducts third-party risk reviews, and completes security questionnaires and client assurance requests. The primary location for this job posting is Palo Alto. The anticipated base pay range is $116,875–$158,125 per year, and compensation may include a discretionary year-end merit bonus based on performance. The firm states that it offers a competitive salary and benefits package.

Requirements

At least 3 years of experience in security risk, governance, and compliance; security operations or incident response experience with demonstrated GRC exposure may also be considered.
Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, and SP 800-39, and understanding of the cybersecurity risk-assessment process.
Working knowledge of IT fundamentals, including networking, identity and access management such as Active Directory, and cloud security such as Microsoft Azure.
Excellent written and verbal communication skills, including the ability to explain risk to technical and non-technical audiences.
Strong organizational, interpersonal, and critical-thinking skills; ability to manage multiple priorities under pressure, work independently, and collaborate with diverse teams.
Sound judgment, high ethical standards, and discretion in handling confidential client information.
Ability to respond promptly to unplanned requests within agreed service-level expectations and accurately estimate project time and resources.
Commitment to continuous learning of new technologies, frameworks, and skills.
Associate’s or Bachelor’s degree in information security, information technology, risk management, or a related field, or an equivalent combination of education, certification, and experience.

Nice To Haves

Relevant certifications, such as CompTIA Security+, CISA, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, Microsoft SC-200, or AZ-500.
Law firm experience, including responding to client security questionnaires and reviewing outside counsel guidelines.
Experience with a GRC platform such as ServiceNow or RSA Archer, and with SIEM, vulnerability, or threat-management tools such as Microsoft Sentinel or Splunk.
Scripting or automation experience, such as Python, PowerShell, or KQL, to streamline recurring GRC reporting and data gathering.
Working knowledge of Claude, Legora, BitSight, and/or Prompt Armor.

Responsibilities

Contribute to implementation and maintenance of the client’s NIST Cybersecurity Framework program, track progress against current and target profiles, and support assessments against related standards such as ISO/IEC 27001, CIS Controls, and SOC 2.
Map current-environment security controls to NIST requirements, including SP 800-53, and other applicable frameworks; perform gap analyses and self-assessments and identify gaps for remediation.
Support delivery of the client’s security risk and compliance standards and maintain related documentation.
Record and maintain security risks in the Risk Register, coordinate with other teams to obtain status, and provide remediation insights.
Contribute requirements, testing, and workflow input to the ServiceNow implementation.
Identify critical- and high-risk systems and processes and document their risk profiles.
Resolve tickets assigned to the GRC team and track them through closure.
Prepare and deliver periodic risk, compliance, and service-level metrics and reports tailored to leadership and stakeholder audiences.
Gather and analyze data from IT systems and security tools, including SIEM and log sources, unauthorized access attempts, and phishing reports; produce reports with specific details.
Use threat, vulnerability, endpoint, and cloud security management systems and tools to identify high-risk systems, create threat-analysis reports, initiate follow-up actions, and help reduce risk.
Partner with security operations and incident response teams to translate incident and vulnerability trends into risk-register entries and remediation recommendations, and maintain related standard operating procedures.
Analyze policies, systems, hardware, software, cloud, and network infrastructure and recommend risk-reduction methods and strategies.
Administer the cybersecurity awareness training program, including assigning courses, tracking completion, and reporting results.
Conduct third-party risk management analysis, including reviewing vendor security documentation and recording results.
Complete security questionnaires and provide supporting documentation within agreed turnaround times.
Perform other related duties as assigned by the client’s GRC leadership.