GRC Engineer

Treasure AI

8h • $108,600 - $131,000 • Remote

About The Position

Treasure AI is hiring a GRC Engineer to design, build, and help operate the systems that power their Trust & Assurance (T&A) program. This role sits at the intersection of security engineering and GRC, focusing on designing, operating, and maintaining systems that make compliance continuous, visible in real-time, and GRC insights actionable. The GRC platform will be treated as a programmable surface, extended via APIs and agent workflows, and integrated with the rest of Treasure AI's tech stack. The engineer will collaborate with GRC Specialists to translate program requirements into technical implementations, and work with Security, IT, Engineering, and Product teams to embed compliance into existing systems and pipelines. AI fluency is a baseline expectation, utilizing agentic tools to accelerate work and building AI-powered automations into GRC workflows.

Requirements

• At least 5 years in Security Engineering, DevSecOps, Technical GRC, or a closely adjacent function — with a demonstrably strong engineering track record in automation and tooling, not just program ownership.
• Strong coding foundation: proficient in Python and/or TypeScript, comfortable calling REST APIs, handling JSON/YAML payloads, building webhooks, and shipping integrations from scratch without hand-holding or assistance. You treat Jira, Confluence, Slack, and similar enterprise tools as systems to integrate with, not just UIs to click through.
• Hands-on experience building automation and integrations in enterprise environments — not just configuring OOTB features, but writing code to extend or connect systems.
• Practical hands-on experience with a modern GRC platform (Vanta, anecdotes, Drata, Secureframe, or similar) — you've configured custom workflows, written rules, and used the APIs; not just the UI.
• Working knowledge of SOC 2, ISO 27001/17/18, ISO 42001 and HIPAA — enough to read a control and determine how to test it programmatically.
• Demonstrated experience shipping AI-assisted automation: agent workflows, prompt pipelines, LLM-integrated integrations, or similar. Comfort with agentic coding tools (Claude Code, Cursor, or equivalent).
• Familiarity with the AWS security control surface (IAM, CloudTrail, Config, GuardDuty) and how to consume compliance signals via API; working knowledge of CI/CD workflows (GitHub Actions or similar) and IaC (Terraform or equivalent) — you understand where compliance checks can be embedded in a deployment pipeline.
• Strong collaboration and written communication skills — able to work across multiple Security domains, IT, Engineering, Legal/Privacy, and GTM, and able to write clear technical documentation.

Responsibilities

• Build AI agent workflows (using Claude, MCP integrations, or similar) to automate repeatable GRC tasks.
• Configure and maintain the technical configuration and extension of our GRC platform — architect data relationships, configure control workflows, build custom rules, and extend the platform via APIs and webhooks rather than relying on the default UI.
• Build automated executive readout workflows so monthly and quarterly GRC reporting is a 30-minute review, not a multi-day build.
• Design and operate automated evidence collection pipelines and continuous control monitoring — pulling signals directly from source systems in real time so drift is surfaced before audit time, not during it.
• Translate controls into testable, codified checks. Identify gaps in compliance coverage across CI/CD pipelines and IaC (Terraform) and contribute compliance logic where gaps exist.
• Embed lightweight compliance checkpoints into design review workflows, ensuring control-relevant changes are flagged before deployment.
• Support FAIR-informed quantitative risk modeling with data pipelines and tooling that make risk scenarios computable rather than narrative-only.
• Build and maintain automation for the TPRM lifecycle — vendor intake, risk scoring, questionnaire distribution, evidence analysis, and remediation tracking — using AI-assisted tooling to reduce per-vendor manual effort.
• Build tooling and dashboards that give the GRC Specialist and business stakeholders a continuous view of privileged access, access exceptions, and open remediation items — replacing point-intime UAR reports with an always-on IGA posture.
• Build and maintain automation across the customer trust surface — AI-assisted questionnaire response pipelines, RFP contribution workflows, and trust center content management — so customer assurance accelerates deals rather than bottlenecking them.
• Build automation across the security awareness and training lifecycle — detecting end-user risk signals or policy violations to improve the culture of security.

Benefits

• Comprehensive medical, dental, vision plans and Employee Assistance Program (EAP)
• Competitive compensation packages
• Company paid life insurance 3x salary
• Company paid short- and long-term disability coverage
• Retirement planning (401K) with 4% company match
• Restricted Stock Units (RSU)
• Flexible Time Off (FTO)
• Up to 26 weeks paid parental leave including a post-partum night nurse
• Comprehensive support and access to care for everyone, everywhere through Carrot - our global reproductive health and family-building benefit.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed