Senior GRC Engineer

Location: Remote

Company

Clerk builds developer infrastructure for user identity, organization management, billing flows, and AI software.

What you will do

• Own SOC 2 Type II and HIPAA programs, including scoping, control design, evidence, auditor walkthroughs, and remediation.
• Scope and lead the next compliance framework, likely ISO 27001, based on customer requirements.
• Build integrations, automations, and internal tools connecting the GRC platform with cloud providers, SaaS tools, and internal systems.
• Turn controls into continuous checks through policy-as-code, configuration drift detection, and control-failure pipelines.
• Run vendor security reviews, security questionnaires, trust center workflows, risk assessments, and risk-register maintenance.
• Embed compliance requirements into the SDLC and change management through tooling.

Requirements

• 5+ years of experience in security, including automation for a GRC or compliance program.
• Technical ownership of at least one SOC 2 Type II or ISO 27001 audit.
• Ability to write code and use LLMs to improve productivity without lowering quality.
• Hands-on experience with a GRC platform API, cloud IAM, and cloud configuration; GCP experience is preferred.
• Ability to determine sufficient audit evidence, defend automated tests to auditors, and work independently in a small security engineering team.
• Strong writing skills for policies, control narratives, and customer-facing questionnaire answers.

Nice to have

• Experience at an all-remote company.
• Production experience shipping LLM or agentic workflows for compliance work.
• Experience at a developer-tools company.

Culture & Benefits

• Competitive salary and stock option plan.
• Health insurance coverage.
• Home-office equipment of choice.
• Flexible, unlimited vacation policy, with 25 days per year recommended.
• National holidays based on the employee's country of residence.
• Diverse and globally distributed team with an inclusive work environment.