GRC Staff Engineer

Fivetran•Denver, CO

2d•$148,788 - $185,985•Hybrid

About The Position

Fivetran is seeking a compliance-focused engineer for its information security organization. The role will build and own a security data lake that aggregates evidence and telemetry from across the company’s environment, using that data to power continuous control monitoring and replace manual control testing with automation. The position also supports core GRC operations, including internal and external audits, risk management, and vendor assessments. The role acts as a subject matter expert within its areas of responsibility, applies internal audit best practices, and stays current with applicable security compliance rules, regulations, and guidance from relevant governing bodies. The position reports to the Director, GRC. The engineer will build and maintain the security data lake on Fivetran’s own platform, govern its data quality, retention, access, and sensitive-data handling, and create automated evidence collection and policy-as-code checks across cloud environments, Kubernetes, CI/CD pipelines, identity, and SaaS systems. The role will integrate and extend GRC tooling and internal platforms to replace manual audit work and provide real-time visibility into control health. It will also support certifications and attestations including ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2, and HITRUST. This is a full-time position based out of the Denver office. Fivetran’s hybrid work model combines remote flexibility with in-person collaboration, including two days in the office each week.

Requirements

At least 5 years of experience in GRC, security engineering, data engineering, or a related field.
Understanding of and ability to perform control testing, documentation, and control design.
Strong SQL skills and proficiency in Python or a similar language for automation and data transformation.
Hands-on experience with a modern data stack, including a cloud warehouse or lake, ETL/ELT, orchestration, and transformation tooling.
Experience automating control testing or replacing manual compliance processes with code-driven checks.
Working knowledge of several frameworks, including the ISO 27001 family, SOC 2, PCI DSS, and HITRUST.
Familiarity with cloud security controls in AWS, GCP, or Azure and common SaaS security configurations.
Ability to translate control language into technical tests and technical results into audit-ready narratives.
Clear written communication skills and comfort working across Security, IT, Engineering, Legal, and Finance.
Advanced security risk or audit certifications are required.

Nice To Haves

Experience dealing with external audits.
Professional audit or information security certifications, such as CISA, CISSP, AWS, or SANS GIAC.
Understanding of control frameworks followed by Fivetran: SOC 1/2, PCI-DSS, ISO 27001, NIST 800-53, ISO 27017, ISO 27018, ISO 27701, ISO 42001, HITRUST, and FedRAMP.
Leading cybersecurity certifications.

Responsibilities

Build and maintain a security data lake on Fivetran’s platform to centralize data used for continuous control monitoring.
Govern the security data lake, including data quality, retention, least-privilege access, and sensitive-data handling.
Build compliance-as-code capabilities, including automated evidence collection, continuous control monitoring, and policy-as-code checks across cloud environments, Kubernetes, CI/CD pipelines, identity, and SaaS systems.
Integrate and extend GRC tooling and internal platforms using APIs, scripts, and workflows to replace manual audit work and provide real-time visibility into control health.
Support Fivetran’s certifications and attestations, including ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2, and HITRUST.
Support internal and external audits, risk management, and vendor assessments.
Perform control testing, documentation, and control design.
Apply internal audit best practices and keep current with applicable security compliance rules, regulations, and authoritative pronouncements.

Benefits

100% employer-paid medical insurance.
Paid vacation or flexible/unlimited vacation, depending on role and country.
Paid sick time.
Inclusive parental leave.
Paid holidays, including a year-end Global Week of Rest.
Volunteer days off.
RSU stock grants.
Professional development and training opportunities.
Company virtual happy hours, free food, and team-building activities.
Monthly cell phone stipend.
Access to a mental health support platform offering therapy, coaching, and self-guided mindfulness resources for covered employees and dependents.