Senior Security Engineer - GRC (AI)

Location: United States

Base salary: $150,000–$170,000 per year. Total compensation may also include a performance bonus, benefits, and other applicable incentive compensation.

Company

hirify.global builds a platform for intentional living through fitness, wellness, and other real-world experiences, including brands such as Mindbody and ClassPass.

What you will do

• Design and maintain framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, using OSCAL where appropriate.
• Own the Master Control List, including control nomenclature, relational database architecture, evidence linkages, and ongoing maintenance across multiple brands.
• Manage the lifecycle of controls, evidence requirements, and implementations as standards change, new standards are adopted, or acquired entities enter scope.
• Build evidence-collection workflows and automation in GRC tooling to reduce manual audit effort.
• Partner with Security Engineering, Legal, Finance, and product teams to validate control design and translate requirements into implementation guidance.
• Design, build, and maintain AI-powered GRC tooling and multi-agent pipelines for risk quantification, evidence automation, vendor risk assessment, and compliance monitoring using cloud-native tools and APIs.

Requirements

• 6+ years of experience in security engineering, GRC, or compliance engineering, with direct hands-on work across multiple regulatory frameworks.
• Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53.
• Experience designing or maintaining control frameworks, crosswalks, or unified control architectures across multiple compliance standards.
• Hands-on experience managing evidence requirements and control implementation, not only documentation.
• Proficiency with compliance automation tooling such as Optro, Drata, Vanta, Hyperproof, Anecdotes, or similar tools.
• Ability to translate technical control design into clear implementation guidance for engineering and product teams.
• Experience building or operating agentic AI workflows, including LLM-based pipelines, multi-agent systems, or RAG architectures, in a production or near-production context.

Nice to have

• Hands-on experience with AWS services including Lambda, Step Functions, EventBridge, S3, and Aurora/RDS for compliance automation infrastructure.
• Experience supporting external audits or assessments as a primary technical contact.
• Exposure to multi-brand or post-acquisition control harmonization.
• Certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP, or PCI ISA.
• Experience in a SaaS or consumer marketplace environment.

Culture & Benefits

• Work across a portfolio including Mindbody, ClassPass, Booker, Kite, and EGYM.
• Collaborate with Engineering, Legal, Finance, and product teams.
• Focus on rigorous, pragmatic, measurable, and durable compliance programs.
• Competitive and equitable compensation based on skills, experience, certifications, and work location.
• Potential performance bonus, benefits, and other applicable incentive compensation.
• Equal opportunity employment with an emphasis on diversity and inclusion.