GRC Engineer (Security Operations)

Location: Santa Clara, California, United States

Salary: $140,000–$170,000 per year

Company

hirify.global develops a network digital twin platform that models production networks across cloud and vendor environments to support autonomous networking, change-impact analysis, and network security.

What you will do

• Build compliance automation, API integrations, and scripts that collect evidence directly from source systems.
• Write and maintain security policies, procedures, control tests, and continuous control-monitoring workflows.
• Manage the GRC platform and lead day-to-day SOC 2 Type II audit activities while preparing for ISO 27001 and ISO 42001.
• Maintain the risk register, conduct risk assessments, and manage vendor security reviews and due diligence.
• Integrate compliance requirements into CI/CD, access provisioning, and change-management workflows.
• Expand into security operations by tuning SIEM/SOAR rules and playbooks, triaging alerts, supporting endpoint incidents, and participating in incident response.

Requirements

• 3+ years of experience in GRC, compliance, security engineering, IT audit, or an equivalent field.
• Experience with control design, risk assessment, compliance frameworks, and writing testable security policies and procedures.
• Hands-on experience with a GRC or compliance-automation platform such as Vanta, Drata, Thoropass, or Anecdotes.
• Solid SOC 2 knowledge; experience with ISO 27001 is beneficial, and interest in AI governance is expected for future ISO 42001 work.
• Ability to read, troubleshoot, and deliver working scripts using Python or Bash, work with SQL, and pull or parse data through APIs and log files.
• Exposure to SIEM/SOAR tools, incident response, endpoint compliance, and Mac-centric environments; ability to communicate with both auditors and engineers.

Nice to have

• Linux administration and scripting experience, plus familiarity with Terraform or policy-as-code.
• Security+, CISA, CISSP, or ISO 27001 Lead Implementer/Auditor certification.
• Experience tuning or migrating SIEM/SOAR systems, conducting incident response, and running tabletop exercises and post-mortems.

Culture & Benefits

• Work across both cloud infrastructure and an internally operated data center.
• Build an evolving GRC Engineering function combining compliance automation and security operations.
• Use automation and source-system evidence instead of manual spreadsheets and recurring evidence collection.