Senior GRC Engineer

Anaplan • New York, NY

8d • $181,000 - $244,000 • Hybrid

About The Position

Anaplan is hiring a Senior GRC Engineer within Security Trust & Risk, which owns governance, risk, compliance, vendor and customer assurance, and business continuity across the company’s ecosystem. This is a ground-floor opportunity to build the technical backbone for operating GRC as an engineering discipline, shifting from point-in-time audits and risk scores to continuous measurement that informs prioritization and high-impact decisions.

The role is based in Anaplan’s New York office and follows a hybrid schedule, with in-person attendance twice a week. As an Engineer III, Security and Compliance, you will bridge GRC and the rest of the business, working with engineering teams on architecture and supporting customer-facing discussions that translate security requirements into practice. The role emphasizes compliance by design: embedding controls, monitoring, and processes so evidence is generated continuously throughout the year.

You will use cross-framework control mapping to identify shared requirements across standards including ISO 27001, 27017, 27018, 27701, and 42001; SOC 1/2 Type 2; Cyber Essentials; ENS; and TX-RAMP. The goal is to help teams implement common controls rather than separate solutions for each certification. You will also make the rationale behind controls clear to business partners, including whether controls address compliance obligations, customer requests, or emerging threats. Over time, you will develop working knowledge of Anaplan’s product and platform, infrastructure, internal systems, and operational security controls.

Requirements

• At least 6 years of experience in security engineering, GRC, DevSecOps, or a closely related technical role, with hands-on exposure to compliance or regulatory frameworks.
• Ability to write scripts or light code, such as Python or Bash, to automate evidence collection, reporting, or monitoring tasks.
• Working knowledge of at least two relevant frameworks, including ISO 27001 and its extensions (27017, 27018, 27701, 42001), SOC 1/2, Cyber Essentials, or similar.
• Experience using cross-framework control mapping or a crosswalk to reduce duplicate implementation effort.
• Comfort building and reading system and data-flow diagrams.
• Proficiency with a GRC or risk platform such as Drata, Vanta, Hyperproof, Archer, OneTrust, ServiceNow GRC, or similar.
• Experience translating compliance and risk requirements into implementation guidance that engineering teams can act on.
• Comfort engaging directly with engineering teams and customers on technical topics, and building processes and tooling in a growing function.

Nice To Haves

• Hands-on experience applying AI or LLM tooling to an operational workflow, such as automating a repetitive review step or summarizing control evidence.
• Familiarity with OSCAL or similar machine-readable control languages.
• Experience with quantitative or semi-quantitative risk scoring methodologies, such as FAIR or similar.
• Experience with FedRAMP and/or HIPAA/HITRUST, especially experience across more than one of these.
• Experience supporting external audits or assessments as a technical point of contact.
• Certifications such as CISA, CISSP, or ISO 27001 Lead Implementer.

Responsibilities

• Act as a technical GRC partner to technical and non-technical teams, translating compliance, governance, and risk requirements into implementation details and participating credibly in architecture and design discussions.
• Use the cross-framework control crosswalk to identify synergies across regulatory requirements and help engineers build common solutions rather than duplicate work for each certification.
• Support customer-facing security and compliance conversations requiring technical context about platform architecture, control implementation, and how obligations are met.
• Build processes, scripts, workflows, and tooling that embed controls into daily operations.
• Design automation that keeps compliance and risk data current continuously rather than refreshing it only before audits.
• Create knowledge-sharing resources, documentation, and diagrams that explain the rationale behind controls, including compliance obligations, customer requests, and emerging threats.
• Partner with Risk Management to engineer risk identification, scoring, and monitoring into day-to-day operations.
• Support continuous monitoring (ConMon) across Compliance, Risk, and Governance.
• Develop working knowledge of the Anaplan product and platform over time.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed