Gainsight GRC Engineer at Gainsight responsible for maintaining governance, risk, and compliance programs and supporting audits. Key duties include managing control frameworks, third-party risk assessments, and automating evidence collection.
Responsibilities
We’re looking for a full-time GRC Engineer to join our Security team reporting to the Director of Security. This role is a remote role based in Mexico.
Maintain multiple control frameworks and map controls to standards
Track control ownership and health
Meet with control owners to address gaps in controls
Scope audits for both internal and external audits
Work with auditors through the audit process from kick-off to completion
Collect and review evidence for all frameworks to ensure compliance and traceability
Track audit findings and remediations to completion
Perform security reviews of all Third-Parties and Vendors
Track vendor remediation items and maintain the vendor inventory
Draft, update, and maintain all security policies, procedures, and standards regularly
Answer customer security questionnaires and requests
Qualification
5+ years of experience in GRCExperience performing risk assessmentsClear written and verbal communicationNice-to-have skills or experienceSecurity certifications such as CISA
Required
5+ years of experience in GRC, security compliance, IT audit, or risk management, ideally within a SaaS or cloud-based company.
Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, and NIST, including how to map controls across them.
Experience supporting external audits and assessments, including scoping, evidence collection, walkthroughs, and tracking findings through remediation.
Experience performing risk assessments, maintaining a risk register, and reviewing the security posture of third-party vendors.
Familiarity with compliance automation or GRC tools, and experience implementing security automation, such as scripting or workflow tools that automate recurring evidence collection and control monitoring.
Understanding of cloud infrastructure and common security controls (access management, logging, encryption, change management) sufficient to evaluate evidence and discuss it with engineers.
Clear written and verbal communication, with the ability to explain control requirements and risk to technical and non-technical teams and to manage several deadlines at once.
Nice-to-have skills or experience:
Experience with AI Governance frameworks.
Previous experience with highly regulated industries that require HIPAA or FedRamp.
Experience working with globally distributed teams.
Security certifications such as CISA, CRISC, or Security+ certifications.
