GRC Staff Engineer

Fivetran • Oakland, CA

2d • $158,707 - $198,384 • Hybrid

About The Position

Fivetran is seeking a compliance-focused engineer for its information security organization. The role will build and own a security data lake that aggregates evidence and telemetry from across the environment, using it to power continuous control monitoring and replace manual control testing with automation. The position also supports core GRC operations, including internal and external audits, risk management, and vendor assessments. It acts as a subject matter expert in assigned areas, applies internal audit best practices, and stays current with applicable security compliance frameworks, rules, regulations, and guidance from relevant governing bodies.

This is a full-time position based out of the Oakland office. Fivetran’s hybrid work model combines remote flexibility with in-person collaboration, including two days in the office each week. The role uses AWS, GCP, Azure, Kubernetes, Secureframe, Wiz, and GitHub.

Requirements

• At least 5 years of experience in GRC, security engineering, data engineering, or a related field.
• Understanding of and ability to perform control testing, documentation, and control design.
• Strong SQL skills and proficiency in Python or a similar language for automation and data transformation.
• Hands-on experience with a modern data stack, including a cloud warehouse or lake, ETL/ELT, orchestration, and transformation tooling.
• Experience automating control testing or replacing manual compliance processes with code-driven checks.
• Working knowledge of several frameworks, including the ISO 27001 family, SOC 2, PCI DSS, and HITRUST.
• Familiarity with cloud security controls in AWS, GCP, or Azure and common SaaS security configurations.
• Ability to communicate clearly in writing and work across Security, IT, Engineering, Legal, and Finance.
• Advanced security risk or audit certifications are required.

Nice To Haves

• Experience dealing with external audits.
• Professional audit or information security certifications, such as CISA, CISSP, AWS, or SANS GIAC.
• Understanding of frameworks followed by Fivetran, including SOC 1/2, PCI-DSS, ISO 27001, NIST 800-53, ISO 27017, ISO 27018, ISO 27701, ISO 42001, HITRUST, and FedRAMP.
• Leading cybersecurity certifications.

Responsibilities

• Build and maintain a security data lake on Fivetran’s platform to centralize data for continuous control monitoring.
• Govern the security data lake by enforcing data quality, retention, least-privilege access, and sensitive-data handling.
• Build compliance-as-code, including automated evidence collection, continuous control monitoring, and policy-as-code checks across cloud environments, Kubernetes, CI/CD pipelines, identity, and SaaS systems.
• Integrate and extend GRC tooling and internal platforms with APIs, scripts, and workflows to replace manual audit work and provide real-time visibility into control health.
• Support Fivetran’s certifications and attestations, including ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2, and HITRUST.
• Support internal and external audits, risk management, and vendor assessments.
• Perform control testing, documentation, and control design.
• Translate control language into technical tests and technical results into audit-ready narratives.
• Apply internal audit best practices and keep current with applicable compliance rules, regulations, and authoritative guidance.

Benefits

• 100% employer-paid medical insurance.
• Paid vacation or flexible/unlimited vacation depending on role and country, paid sick time, inclusive parental leave, paid holidays, a year-end Global Week of Rest, and volunteer days off.
• RSU stock grants.
• Professional development and training opportunities.
• Company virtual happy hours, free food, and team-building activities.
• Monthly cell phone stipend.
• Access to a mental health support platform offering therapy, coaching, and self-guided mindfulness resources for covered employees and their covered dependents.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed