GRC Engineer

Apex Fintech Solutions • Dallas, TX

10d • Hybrid

About The Position

Apex Fintech Solutions is seeking a hands-on, technically minded GRC Engineer to build, scale, and operate its governance, risk, and compliance program. The role combines traditional GRC work—including audits, risk management, policies, and due diligence—with engineering-oriented work such as API integrations, data querying, and control automation.

The GRC Engineer will help maintain compliance across frameworks including SOC 2, NIST CSF, and ISO 27001, and modernize control monitoring and evidence collection using platforms such as Anecdotes or equivalent tools. The position works with auditors and collaborates with security, engineering, business, customer, and partner stakeholders. Apex offers a hybrid work schedule for most roles, with flexibility to work from home and from a primary office.

Requirements

• 2–5+ years of experience in GRC, information security compliance, IT audit, or a closely related field.
• Hands-on experience with SOC 2 audits as a practitioner preparing evidence, rather than solely as an auditor.
• Working knowledge of NIST CSF and ISO 27001, or similar frameworks such as PCI DSS or HITRUST.
• Experience with a GRC automation platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC, or similar.
• Comfort working with API integrations to ingest data for compliance monitoring and control building.
• Working proficiency in SQL or similar query languages to analyze and validate compliance data.
• Experience drafting and maintaining information security policies and procedures.
• Strong written and verbal communication skills, including the ability to translate technical findings for auditors and executives.
• Ability to manage multiple concurrent audits or assessments and shifting priorities.

Nice To Haves

• Experience in fintech, financial services, or another regulated industry.
• Familiarity with vendor or third-party risk management programs and DDQ response processes.
• Exposure to cloud environments such as AWS, Azure, or GCP and common security tooling such as IAM, SIEM, and ticketing systems.
• Scripting ability in Python or a similar language for light automation of GRC workflows.
• Relevant certifications such as CISA, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor, or similar.

Responsibilities

• Own or co-own preparation for and execution of SOC 2 Type I and Type II audits, working with external auditors on scoping, evidence, and remediation.
• Lead or support NIST CSF assessments and gap analyses, and translate results into remediation plans.
• Support ISO 27001 alignment and readiness, as well as other applicable frameworks and regulations such as PCI DSS and GLBA.
• Maintain a unified control framework that maps overlapping requirements across standards.
• Build and maintain continuous compliance monitoring using a GRC platform.
• Configure and manage automated evidence collection through API integrations with cloud, identity, ticketing, and infrastructure systems.
• Design and implement controls using ingested data, ensuring accuracy, freshness, and appropriate alerts for control drift or failures.
• Query and analyze compliance and security data to validate control effectiveness and produce audit-ready evidence.
• Maintain the control library, risk register, and policy and procedure repository.
• Support enterprise risk assessments, including risk identification, scoring, tracking, and remediation.
• Maintain third-party and vendor risk management processes, including assessments and ongoing monitoring.
• Partner with security, engineering, and business teams to ensure risks are understood, assigned, and addressed.
• Respond to DDQs, RFPs, and customer security questionnaires with accurate, timely, documented answers.
• Maintain a trust center or security documentation repository and serve as a subject matter resource on Apex's security and compliance posture.
• Draft, maintain, and periodically review information security and compliance policies and procedures.
• Support policy attestation, training, and awareness campaigns.
• Coordinate internal and external audit logistics, evidence requests, and stakeholders.
• Contribute to leadership and board metrics and reporting on compliance and risk posture.
• Identify opportunities to automate manual GRC workflows.

Benefits

• Healthcare benefits, including medical, dental, vision, and EAP.
• Competitive PTO.
• 401k match.
• Parental leave.
• HSA contribution match.
• Paid subscription to the Calm app.
• External learning benefits.
• Tuition reimbursement.
• Hybrid work schedule for most roles, with flexibility to work from home and a primary office.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed