Sr Engineer, GRC (Audit & Compliance)

NextGen Federal Systems•Remote GA, GA

11d

About The Position

The Sr. Engineer, Governance, Risk & Compliance (Audit & Compliance) is responsible for leading the organization’s audit and compliance programs, ensuring continuous alignment with regulatory, contractual, and security framework requirements. This role owns the end-to-end audit lifecycle, including planning, readiness, evidence management, auditor coordination, and remediation tracking across frameworks such as SOC 2, HITRUST, PCI DSS, HIPAA, and NIST CSF. The individual will act as the primary liaison between internal stakeholders and external auditors, ensuring audit readiness and sustained compliance posture. This position operates as a senior individual contributor responsible for driving compliance execution, maintaining control frameworks, and leveraging GRC tools to enable scalable and efficient compliance operations. Leverage tools and technology to support Information Security audit, compliance, and GRC initiatives across the Information Security Program Act as system administrator for certain security or GRC tools such as phishing and training platforms, GRC/IT Risk Management tools, Third Party Risk Management (TPRM) platforms, Risk Register, privacy management, etc. Integrate related tools and workflows with other systems as needed. Engage with internal stakeholders and security vendors on design sessions, and help configure and optimize GRC solutions and compliance workflows. Work with IT partners in Application Security, Security Engineering and Operations, Enterprise Applications, Desktop Support, Help Desk, Networking and Infrastructure Operations, to get data and information needed to support GRC work and audit & compliance activities. Collaborate with IT teams and Information Security teams to obtain security and operational data needed to support audit, compliance, and risk assessment activities. Work with IT teams and partners to align GRC objectives with enterprise security controls and operational processes including cybersecurity / technology solutions such as IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPS, XDR, MDM, SIEM, etc. Support data analysis, metrics, dashboards and reporting activities by pulling data from source systems. Stay current with evolving regulatory requirements, compliance frameworks, industry trends, threat intelligence and make recommendations for process and control improvements. Participate in security incidents and support related audit, compliance and remediation activities as needed. Support security assessment requests for customers, HITRUST, SOC 2, etc. by pulling appropriate data as needed. Work with IT partners to align GRC requirements with operational processes such as secure software development life cycle, software engineering, infrastructure, network, etc. Maximize the utilization of GRC tools and technology to improve program efficiency and audit readiness Assist with the development and maintenance of policies, procedures and compliance documentation. Stay current with changes in information security and cybersecurity regulations, industry frameworks, and best practices, and apply them to existing NextGen GRC solutions and processes. Use GRC and security engineering skills to help streamline or automate NextGen methodology for maintaining accreditations or certifications (e.g., SOC 2, HITRUST, etc.). Use GRC and security engineering skills to help streamline or automate NextGen methodology for responding to customer security assessments or questionnaires.

Requirements

Bachelor's Degree in Computer Science or related discipline or advanced degree, or any combination of education and experience which would provide the required qualifications for the position.
4-6 years of relevant experience or advanced Degree.
GRC/Security engineering experience, including supporting information security or cybersecurity solutions.
Experience working with security technology, GRC tools, or processes such as phishing campaigns, vulnerability scans, IRPs, playbooks, IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPS, XDR, MDM, SIEM, threat hunting, etc.
Experience with one or more of the following frameworks: COSO, NIST CSF, RMF, ISO, COBIT.
Experience working in an environment with one or more of the following: Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley Act (SOX), AICPA System and Organization Controls 2(SOC 2), Payment Card Industry (PCI), or related GRC frameworks.
Experience working with IT partners and adequate exposure to their areas such as SSDLC, software engineering, infrastructure, networking, service desk, desktop support, security operations, etc. This includes experience or sufficient exposure and familiarity with the tools they use.
Information security or cybersecurity related certifications such as CISA, CISSP, CISM, CRISC, CEH, GIAC (GCFA), or ability to acquire certification within 18 months.
HITRUST Framework and CSF certification knowledge.
Governance, Risk and Compliance tools knowledge.
Knowledge of GRC, information security, and cybersecurity principles, phishing campaigns, cybersecurity awareness and training, risk assessments, risk registers, security events and incidents, security frameworks, standards, guidelines, controls, federal and state security regulations and trends, current cybersecurity threats, data protection, administrative, technical and physical security controls, third party risk management (TPRM).
Knowledge of IT / security processes or tools such as IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPS, XDR, MDM, SIEM, IRP, backups, DR & BCP, playbooks, MSP or MSSP, MDR or XDR, 24x7 SOC, endpoint security, SIEM, vulnerability scans, patching, pen testing, red/blue/purple teaming, tabletop exercises, encryption at rest and in transit, networking, firewalls, infrastructure, colo data centers, hosted environments such as Azure, AWS, or Google Cloud, and Active Directory.
Skill in Information security, cybersecurity, GRC processes, audit and compliance activities, some understanding of code and scripts, working as member of a team; communicating effectively; establishing and maintaining effective working relationships.
Ability to determine how a system should work and how changes in conditions, operations, and the environment will affect outcomes; work in a fast-paced environment; stay organized, prioritize workload, multi-task, and meet deadlines.

Responsibilities

Leading the organization’s audit and compliance programs, ensuring continuous alignment with regulatory, contractual, and security framework requirements.
Owning the end-to-end audit lifecycle, including planning, readiness, evidence management, auditor coordination, and remediation tracking across frameworks such as SOC 2, HITRUST, PCI DSS, HIPAA, and NIST CSF.
Acting as the primary liaison between internal stakeholders and external auditors, ensuring audit readiness and sustained compliance posture.
Driving compliance execution, maintaining control frameworks, and leveraging GRC tools to enable scalable and efficient compliance operations.
Leveraging tools and technology to support Information Security audit, compliance, and GRC initiatives.
Acting as system administrator for certain security or GRC tools such as phishing and training platforms, GRC/IT Risk Management tools, Third Party Risk Management (TPRM) platforms, Risk Register, privacy management, etc.
Integrating related tools and workflows with other systems as needed.
Engaging with internal stakeholders and security vendors on design sessions, and helping configure and optimize GRC solutions and compliance workflows.
Working with IT partners to get data and information needed to support GRC work and audit & compliance activities.
Collaborating with IT teams and Information Security teams to obtain security and operational data needed to support audit, compliance, and risk assessment activities.
Aligning GRC objectives with enterprise security controls and operational processes including cybersecurity / technology solutions such as IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPS, XDR, MDM, SIEM, etc.
Supporting data analysis, metrics, dashboards and reporting activities by pulling data from source systems.
Staying current with evolving regulatory requirements, compliance frameworks, industry trends, threat intelligence and making recommendations for process and control improvements.
Participating in security incidents and supporting related audit, compliance and remediation activities as needed.
Supporting security assessment requests for customers, HITRUST, SOC 2, etc. by pulling appropriate data as needed.
Aligning GRC requirements with operational processes such as secure software development life cycle, software engineering, infrastructure, network, etc.
Maximizing the utilization of GRC tools and technology to improve program efficiency and audit readiness.
Assisting with the development and maintenance of policies, procedures and compliance documentation.
Staying current with changes in information security and cybersecurity regulations, industry frameworks, and best practices, and applying them to existing NextGen GRC solutions and processes.
Using GRC and security engineering skills to help streamline or automate NextGen methodology for maintaining accreditations or certifications (e.g., SOC 2, HITRUST, etc.).
Using GRC and security engineering skills to help streamline or automate NextGen methodology for responding to customer security assessments or questionnaires.