GRC Engineer

APEX Fintech Services • Dallas, TX

9d • Hybrid

About The Position

Apex Fintech Solutions is seeking a hands-on GRC Engineer to help build, scale, and operate its governance, risk, and compliance program. The role combines traditional GRC work—including audits, risk management, policy, and due diligence—with engineering-oriented work such as API integrations, data querying, and control automation. The GRC Engineer will help maintain compliance across SOC 2, NIST CSF, and ISO 27001, and modernize control monitoring and evidence collection with platforms such as Anecdotes. The position involves working with auditors, security and engineering teams, business stakeholders, customers, prospects, and partners.

Responsibilities include preparing for and supporting audits and framework assessments; maintaining unified controls, policies, risks, and compliance evidence; building automated monitoring and evidence collection; analyzing compliance data; managing enterprise and third-party risks; responding to customer due diligence requests; and supporting policy, training, reporting, and continuous improvement. The description notes that duties and responsibilities may change at any time.

Apex describes its work as providing fintech software that simplifies, automates, and facilitates access to financial markets. The company reports more than 1,000 employees across offices in Austin, Dallas, Chicago, New York, Portland, Belfast, and Manila, and says its platform supports access to the stock market for more than 22 million end customers. Most roles offer a hybrid schedule, with flexibility to work from home and from a primary office.

Requirements

• 2–5+ years of experience in GRC, information security compliance, IT audit, or a closely related field.
• Hands-on experience with SOC 2 audits as a practitioner preparing evidence, rather than solely as an auditor.
• Working knowledge of NIST CSF and ISO 27001, or similar frameworks such as PCI DSS or HITRUST.
• Experience with a GRC automation platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC, or similar.
• Comfort working with API integrations to ingest data for compliance monitoring and control building.
• Working proficiency in SQL or similar query languages for analyzing and validating compliance data.
• Experience drafting and maintaining information security policies and procedures.
• Strong written and verbal communication skills, including the ability to translate technical findings for auditors and executives.
• Ability to manage multiple concurrent audits or assessments and shifting priorities.

Nice To Haves

• Experience in fintech, financial services, or another regulated industry.
• Familiarity with vendor or third-party risk management programs and DDQ response processes.
• Exposure to AWS, Azure, or GCP and common security tooling such as IAM, SIEM, and ticketing systems.
• Scripting ability in Python or a similar language for light automation of GRC workflows.
• Relevant certifications such as CISA, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor, or similar.

Responsibilities

• Own or co-own preparation for and execution of SOC 2 Type I and Type II audits, working with external auditors on scoping, evidence, and remediation.
• Lead or support NIST CSF assessments and gap analyses and translate results into remediation plans.
• Support ISO 27001 readiness and alignment, as well as other relevant frameworks and regulatory requirements.
• Maintain a unified control framework mapping overlapping requirements across standards.
• Build and maintain continuous compliance monitoring using GRC platforms such as Anecdotes or equivalent tools.
• Configure and manage automated evidence collection through API integrations with cloud, identity, ticketing, and infrastructure systems.
• Design and implement controls that use ingested data, and ensure accuracy, freshness, and suitable alerting for control drift or failures.
• Query and analyze compliance and security data using SQL or platform-native query languages to validate controls and produce audit-ready evidence.
• Maintain the control library, risk register, and policy and procedure repository.
• Support enterprise risk assessments, including risk identification, scoring, tracking, and remediation.
• Maintain third-party and vendor risk management processes, including assessments and ongoing monitoring.
• Partner with security, engineering, and business teams to ensure risks are understood, owned, and addressed in a reasonable timeframe.
• Respond to DDQs, RFPs, and customer security questionnaires with accurate, timely, documented answers.
• Maintain a trust center or security documentation repository for recurring due diligence requests.
• Serve as a subject matter resource for prospects, customers, and partners regarding Apex's security and compliance posture.
• Draft, maintain, and periodically review information security and compliance policies and procedures.
• Ensure policies align with current frameworks, regulatory obligations, and operational practices.
• Support policy attestation, training, and awareness campaigns.
• Support internal and external audit logistics, evidence requests, and stakeholder coordination.
• Contribute to leadership and board metrics and reporting on compliance and risk posture.
• Identify opportunities to automate manual GRC workflows.

Benefits

• Healthcare benefits, including medical, dental, vision, and EAP.
• Competitive paid time off.
• 401(k) match.
• Parental leave.
• HSA contribution match.
• Paid Calm app subscription.
• External learning benefits.
• Tuition reimbursement.
• Hybrid work schedule for most roles, with flexibility to work from home and a primary office.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed