Senior Security Engineer - GRC

ClassPass

10d•$150,000 - $170,000

About The Position

Playlist is hiring a Senior GRC Engineer to own the technical architecture of its control environment across a growing portfolio of brands, including Mindbody, ClassPass, Booker, Kite, and EGYM. The role focuses on building a scalable, durable approach to governance, risk, and compliance that is embedded in day-to-day systems and operations. The position centers on two workstreams: developing and maintaining a Master Control List mapped across multiple compliance frameworks, and managing the lifecycle of controls and evidence requirements as standards change or newly acquired brands enter scope. The engineer will build framework crosswalks, improve evidence automation, and work across Security Engineering, Legal, Finance, and product teams to make controls actionable and aligned with business operations. The role also includes designing and maintaining AI-powered GRC tools and agentic workflows for risk quantification, evidence automation, vendor risk assessment, and compliance monitoring. The successful candidate will help rationalize overlapping framework requirements, reduce duplicated audit work, and scale the team's analytical and operational capacity.

Requirements

At least 6 years of experience in security engineering, GRC, or compliance engineering, with hands-on work across multiple regulatory frameworks.
Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53.
Experience designing or maintaining control frameworks, crosswalks, or unified control architectures across multiple compliance standards.
Hands-on experience managing evidence requirements and control implementation, beyond documentation.
Proficiency with compliance automation tools such as Optro, Drata, Vanta, Hyperproof, Anecdotes, or similar.
Ability to translate technical control design into clear implementation guidance for engineering and product teams.
Experience building or operating agentic AI workflows, including LLM-based pipelines, multi-agent systems, or RAG architectures, in a production or near-production context.

Nice To Haves

Hands-on experience with AWS services such as Lambda, Step Functions, EventBridge, S3, and Aurora/RDS for compliance automation infrastructure.
Experience supporting external audits or assessments as a primary technical contact.
Exposure to multi-brand or post-acquisition control harmonization.
Certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP (HITRUST), or PCI ISA.
Experience in a SaaS or consumer marketplace environment.

Responsibilities

Design and build framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, using languages such as OSCAL.
Own the Master Control List, including control nomenclature, relational database architecture, evidence linkages, and ongoing maintenance across multiple brands.
Manage the lifecycle of controls, evidence requirements, and implementation as standards are adopted or updated and acquired entities are brought into scope.
Drive evidence automation in GRC tooling by building scalable collection workflows.
Partner with Security Engineering, Legal, and Finance to validate control design and translate compliance requirements into implementation guidance for engineering teams.
Design, build, and maintain AI-powered GRC tooling and multi-agent pipelines for risk quantification, evidence automation, vendor risk assessment, and compliance monitoring.
Identify opportunities to rationalize requirements across frameworks and reduce duplicated work when adding standards.