Senior GRC Engineer

Anaplan • New York City, NY

8d • Hybrid

About The Position

Anaplan’s Security Trust & Risk team owns governance, risk, compliance, vendor and customer assurance, and business continuity across the company’s ecosystem. This is a ground-floor opportunity to help build the technical foundation for operating GRC as an engineering discipline, shifting from point-in-time audits and risk scores toward continuous measurement that supports prioritization and high-impact decisions. The role is based in Anaplan’s New York office and follows a hybrid schedule, with in-person attendance twice a week.

The Senior GRC Engineer serves as a technical partner to GRC, engineering, other business teams, and customers. The role translates compliance, governance, and risk requirements into practical implementation guidance, participates in architecture and design discussions, and supports customer-facing conversations requiring technical security context. Its focus is compliance by design: embedding controls, monitoring, processes, and automation into day-to-day operations so evidence and risk data remain current throughout the year.

The role uses Anaplan’s cross-framework control crosswalk to identify genuine overlap among certified standards and help teams implement common controls rather than duplicating work for each certification. It also makes the rationale for controls clear to business partners, explaining whether a control addresses a compliance obligation, customer request, or emerging threat. Over time, the engineer develops working knowledge of Anaplan’s product and platform, infrastructure, internal systems, and operational security controls.

Requirements

• At least 6 years of experience in security engineering, GRC, DevSecOps, or a closely related technical role, with hands-on exposure to compliance or regulatory frameworks.
• Comfort writing scripts or light code, such as Python or Bash, to automate evidence collection, reporting, or monitoring tasks.
• Working knowledge of at least two relevant frameworks, including ISO 27001 and its extensions (27017, 27018, 27701, 42001), SOC 1/2, Cyber Essentials, or similar.
• Experience using cross-framework control mapping or a crosswalk to reduce duplicate implementation effort.
• Ability to build and read system and data-flow diagrams.
• Proficiency with a GRC or risk platform, such as Drata, Vanta, Hyperproof, Archer, OneTrust, ServiceNow GRC, or similar.
• Experience translating compliance or risk requirements into actionable implementation guidance for engineering teams.
• Comfort engaging directly with engineering teams and customers on technical topics, and building processes or tooling in a growing function.

Nice To Haves

• Hands-on experience applying AI or LLM tooling to an operational workflow, such as automating a repetitive review step or summarizing control evidence.
• Familiarity with OSCAL or similar machine-readable control languages.
• Experience with quantitative or semi-quantitative risk scoring methodologies, such as FAIR.
• Experience with FedRAMP and/or HIPAA/HITRUST, especially across more than one of these.
• Experience supporting external audits or assessments as a technical point of contact.
• Certifications such as CISA, CISSP, or ISO 27001 Lead Implementer.

Responsibilities

• Act as a technical GRC partner to technical and non-technical teams, translating compliance, governance, and risk requirements into implementation details and participating credibly in architecture and design discussions.
• Use the cross-framework control crosswalk to identify synergies across regulatory requirements and help engineering teams build common solutions rather than duplicate work for each certification.
• Support customer-facing security and compliance discussions that require technical context about platform architecture, control implementation, and how obligations are met.
• Build processes, scripts, workflows, and tooling that embed controls into daily operations and keep compliance and risk data continuously current.
• Create knowledge-sharing resources, documentation, and diagrams that explain the reasoning behind controls, including whether they address compliance obligations, customer requests, or emerging threats.
• Partner with Risk Management to engineer risk identification, scoring, and monitoring into day-to-day operations.
• Support continuous monitoring across Compliance, Risk, and Governance.
• Build working knowledge of the Anaplan product and platform over time.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed