GRC Engineer (Fintech)

Location: Dallas, United States; hybrid work schedule

Company

hirify.global builds fintech software for digital wealth management and financial-market access, serving more than 22 million end customers through clients including Stash, Betterment, SoFi, Webull, and eToro.

What you will do

• Own or co-own SOC 2 Type I/II audit preparation and execution, including scoping, evidence collection, auditor coordination, and remediation.
• Lead or support NIST CSF assessments, gap analyses, ISO 27001 readiness, and control-framework mapping across applicable standards and regulations.
• Build continuous compliance monitoring with Anecdotes or equivalent GRC platforms, including API-based evidence collection and automated controls.
• Query and analyze compliance and security data to validate control effectiveness and produce audit-ready evidence.
• Manage risk registers, enterprise and third-party risk processes, policies, procedures, audit logistics, and compliance reporting.
• Respond to DDQs, RFPs, and customer security questionnaires while supporting the trust center and customer security discussions.

Requirements

• 2–5+ years of experience in GRC, information security compliance, IT audit, or a closely related field.
• Hands-on practitioner experience preparing evidence for SOC 2 audits.
• Working knowledge of NIST CSF and ISO 27001, or similar frameworks such as PCI DSS or HITRUST.
• Experience with a GRC automation platform such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC, or a similar tool.
• Experience using API integrations to ingest data for compliance monitoring and control building.
• Working proficiency in SQL or similar query languages for analyzing and validating compliance data.
• Experience drafting and maintaining information security policies and procedures.
• Strong written and verbal communication skills, including translating technical findings for auditors and executives.
• Ability to manage multiple concurrent audits or assessments and shifting priorities.

Nice to have

• Experience in fintech, financial services, or another regulated industry.
• Familiarity with vendor and third-party risk management and DDQ response processes.
• Exposure to AWS, Azure, or GCP and security tooling such as IAM, SIEM, and ticketing systems.
• Python or similar scripting ability for light GRC workflow automation.
• Certifications such as CISA, CISSP, CRISC, or ISO 27001 Lead Implementer/Auditor.

Culture & Benefits

• Hybrid schedule with flexibility to work from home and from a primary office for most roles.
• Healthcare benefits including medical, dental, vision, EAP, HSA contribution matching, and a 401k match.
• Competitive PTO, parental leave, paid Calm subscription, and external learning and tuition reimbursement.
• Collaborative environment focused on grit, results, empathy, accountability, and teamwork.
• Equal opportunity and reasonable accommodation support are provided throughout the hiring process.