GRC Engineer (Governance Risk and Compliance)

Coterie

1d • $115,000 - $140,000 • Remote

About The Position

Coterie's GRC team is seeking a hands-on technical GRC Engineer to build, test, and improve the management and validation of security, technology, and compliance controls. The role focuses on continuous control monitoring, application and technology control testing, risk evaluation, and collecting and validating audit evidence directly from source systems.

The GRC Engineer will develop and perform control testing, identify control and process gaps, assess related risks, and recommend practical remediation or compensating controls. The position also supports broader GRC initiatives, including risk management, business continuity and disaster recovery, privacy, third-party risk management, governance, and regulatory compliance. The role is remote and is intended for a full-time employee.

Requirements

• At least 4 years of relevant experience in IT audit, GRC, information security, security assurance, technology risk, or related disciplines.
• Hands-on experience testing technical security and technology controls and supporting audits or assessments such as SOC 2, SOX/ITGC, ISO 27001, NYDFS, NIST, or similar.
• Strong understanding of security control domains, including identity and access management, logging and monitoring, vulnerability and endpoint management, cloud security, change management, SDLC, and backup and recovery.
• Ability to independently retrieve, interpret, and validate technical evidence, including system configurations, access data, logs, vulnerability results, change records, and system-generated reports, and assess its completeness and accuracy.
• Working knowledge of SQL, KQL, PowerShell, or similar tools for querying, analyzing, and validating system data used in control testing.
• Ability to evaluate control design and operation, understand underlying risks, identify deficiencies and root causes, and recommend practical remediation or compensating controls.
• Strong analytical, communication, and professional judgment skills.
• Ability to work independently and effectively with technical teams, auditors, control owners, and other stakeholders.
• Authorization to work in the United States without requiring current or future visa sponsorship.

Nice To Haves

• Experience with Azure, Entra ID, Microsoft 365, SIEM/SOAR, endpoint, vulnerability management, or other cloud and security tooling.
• Experience with continuous control monitoring, automated evidence collection, APIs, scripting, or integrations.
• Experience with GRC/IRM platforms such as Optro/AuditBoard or similar.
• Experience in insurance, financial services, fintech, or another regulated industry.
• Familiarity with NYDFS 23 NYCRR Part 500, NAIC, PCI DSS, or NIST CSF requirements.
• CISA, CRISC, CISSP, CISM, Security+, or similar certification.

Responsibilities

• Build and maintain repeatable testing and monitoring processes for security, technology, and application controls.
• Define control testing procedures, evidence requirements, frequency, expected results, and exception criteria.
• Perform control testing to assess design and operating effectiveness, and document procedures, results, and conclusions.
• Identify control failures, process gaps, control drift, and evidence deficiencies, and assess their risk and compliance impact.
• Investigate deficiencies and work with control owners on practical remediation or compensating controls.
• Design and implement solutions to automate evidence collection, control testing, and continuous monitoring using queries, scripts, APIs, integrations, and GRC tools where appropriate.
• Retrieve evidence directly from applications and source systems for audits, assessments, and control testing.
• Build and document repeatable procedures for collecting and validating technical evidence, including system reports, configurations, access data, logs, vulnerability results, and change records.
• Validate the completeness, accuracy, scope, and reliability of system-generated evidence and data used for testing and audits.
• Support SOC 2, ITGC/SOX readiness, NYDFS, and other audit and compliance activities, including walkthroughs, evidence requests, testing, and auditor follow-up.
• Maintain organized, audit-ready evidence and testing documentation, and retest remediated controls as needed.
• Assess the effectiveness of security and technology controls in mitigating associated risks.
• Translate regulatory, audit, and security requirements into practical control requirements and testing procedures.
• Recommend control improvements, compensating controls, or other risk treatment options based on identified gaps and risks.
• Support technical risk assessments, remediation planning, and other risk management activities.
• Support GRC initiatives across risk management, business continuity and disaster recovery, privacy, third-party risk management, governance, and regulatory compliance.
• Identify and implement opportunities to use automation, AI, and other technologies to improve GRC processes while maintaining appropriate security, privacy, data handling, and human oversight.
• Build and document processes, procedures, testing approaches, and supporting materials as GRC programs mature.
• Partner with business and technical teams on assessments, remediation efforts, and other GRC priorities.

Benefits

• Health insurance through Aetna, with premiums paid 100% by the company.
• Dental and vision insurance through Guardian, with premiums paid 100% by the company.
• Basic life insurance, with premiums paid 100% by the company.
• Access to a flexible spending account (FSA) or health savings account (HSA) for employees using HSA-eligible plans.
• 401(k) plan with up to a 4% match and immediate vesting; participation requires being at least 21 years old.
• Flexible PTO policy offering up to 4 weeks during the first 12 months; thereafter, PTO aligns with company standards and typically does not exceed 5 weeks per calendar year.
• 12 company-paid holidays each year.
• Annual continuing education stipend.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed