GRC Engineer (AI Security)

Location: Boston, MA, United States; hybrid

Base salary: $130K–$180K annually, plus equity

Company

AI security company building a federated SIEM and AI agents for detection, investigation, response, threat hunting, and threat intelligence.

What you will do

• Manage the compliance program through a compliance automation platform, keeping controls, evidence, and integrations current.
• Prepare for and support SOC 2, ISO, FedRAMP, and other regulatory framework audits and assessments.
• Run internal audits, test controls, document findings, and track remediation through closure.
• Manage third-party risk by assessing vendors, reviewing security documentation, and maintaining the vendor risk register.
• Support customers and vendors with security questionnaires, compliance documentation, assurance requests, evidence collection, and gap closure.
• Track GRC initiatives, maintain policies and risk records, and use AI to automate repeatable work such as evidence collection, questionnaire responses, and control testing.

Requirements

• 5+ years of experience in GRC, compliance, or security risk.
• Hands-on experience supporting SOC 2 audits and working knowledge of ISO 27001, ISO 42001, and FedRAMP.
• Experience running third-party risk management, including vendor assessments.
• Experience with a compliance automation platform such as Scytale, Vanta, or Drata.
• Experience running internal audits or control testing.
• Comfort communicating with customers and vendors about security in plain language.
• Strong project tracking habits and a record of keeping stakeholders informed.
• Practical experience using AI tools to accelerate work and identify further automation opportunities.
• A proactive, execution-oriented mindset.

Nice to have

• Bachelor’s or master’s degree.
• Hands-on experience with SaaS compliance automation platforms.
• Experience in a security vendor or fast-growing startup, especially in customer-facing security assurance.
• Exposure to AI governance, such as ISO 42001 or the NIST AI RMF.
• Scripting skills such as Python or SQL for automating evidence collection and reporting.
• Certifications such as CISA, CRISC, CISSP, ISO 27001 Lead Auditor, or ISO 27001 Lead Implementer.

Culture & Benefits

• Hybrid work arrangement in Boston, MA.
• Respectful, collaborative culture with a shared standard of excellence.
• Opportunity to shape an early-stage AI security company.
• Equity included in the compensation package.