GRC Engineer

Forward•Santa Clara, CA

5d•$140,000 - $170,000

About The Position

Forward is seeking a GRC Engineer to build scripts and API integrations for compliance automation, moving beyond traditional screenshot-based evidence gathering. This role initially focuses on GRC Engineering, including compliance automation, audit management (SOC 2, ISO 27001/42001), control design and testing, and risk management. After critical automations are in place, the role will expand to include Security Operations, primarily SIEM and SOAR work, and incident response. The ideal candidate will have engineering skills that enable doing more than a traditional GRC Analyst role and can grow to handle both GRC and SecOps responsibilities.

Requirements

3+ years in GRC, compliance, security engineering, IT audit, or equivalent, with on-the-job exposure to control design, risk assessment, AND compliance frameworks.
Experience writing policies and procedures, with a focus on testable and verifiable outcomes.
Time spent doing real work in a GRC/compliance automation platform (Vanta, Drata, Thoropass, Anecdotes, or similar).
Solid working knowledge of SOC 2. ISO 27001 experience is a plus.
Basic scripting knowledge: Python or Bash, SQL, and comfortable pulling data from an API, parsing a log file, or automating something you used to do by hand.
Some exposure to SIEM/SOAR tooling (Splunk, Chronicle, Panther, XSOAR, Tines, whatever you've used) and a basic feel for how incident response actually runs.
The ability to speak to an auditor and an engineer in languages they understand.
A tolerance for ambiguity.
Experience with endpoint compliance in a Mac-centric environment.

Nice To Haves

Comfort with straight Linux administration and scripting.
Experience with Terraform or policy-as-code.
Certs like Security+, CISA, CISSP, or ISO 27001 Lead Implementer/Auditor.
Time spent tuning or migrating a SIEM/SOAR setup, or running incident response for real, not just in a tabletop exercise.
Understanding tabletop exercises, how to run them, how to conduct a post-mortem and how to drive the findings to completion with stakeholders.
Curiosity about AI governance.

Responsibilities

Write, maintain, and actively drive review cycles for security policies and procedures.
Build control tests that verify real system configurations directly at the source, rather than manual spreadsheets.
Manage and extend our GRC platform (Vanta, Drata, etc.) using scripts and API integrations.
Continuously manage control drift between audits and drive remediation to completion.
Lead day-to-day SOC 2 Type II audits and lay groundwork for ISO 27001 and ISO 42001.
Maintain a prioritized risk register and run actionable risk assessments.
Handle vendor security reviews and due diligence by pulling evidence from a vendor's API or trust page.
Integrate compliance requirements directly into engineering workflows, such as CI/CD, access provisioning, and change management.
Tune detection rules, correlation logic, and response playbooks for SIEM & SOAR.
Assist with EDR, DLP, and endpoint break/fix and incident response cases.
Participate in security alert triage and documentation.
Investigate, help contain, and write post-mortems for security incidents.
Feed insights from Security Operations back into the GRC side of the job to identify gaps.