Senior GRC Engineer

New York, NYfull timeRemote

senior

$154k–$192k

H1B: yes

Brex The Senior GRC Engineer at Brex leads IT security compliance workstreams including SOX/ITGC testing and SOC 1 Type 2 engagement. This role coordinates with auditors and manages risk-related operational tasks in a hybrid Vancouver office setting.

Responsibilities

As a Senior GRC Engineer at Brex, you’ll lead the IT security compliance workstreams that connect our technical control owners to the people who examine our controls: external auditors, Internal Audit, state regulators, and Finance. You’ll coordinate and test the technical controls behind our financial reporting (SOX/ITGC), our annual SOC 1 Type 2 report, our state money transmitter examinations, and our FINRA IT requirements. You’ll also run the annual business continuity and disaster recovery (BC/DR) testing calendar.
As part of the GRC team you may also contribute to the following operational tasks:
Third party risk management
Risk register maintenance and reporting
Customer Trust / GTM due diligence support
Tooling access requests
Assist with requests related to other certifications like SOC 2 Type 2, PCI DSS, or ISO 27001
Where you’ll work
This role will be based in our Vancouver office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work!
Lead IT SOX/ITGC test procedures, walkthroughs, evidence, workpapers, and remediation across logical access, change management, computer operations, and IT governance.
Manage our annual SOC 1 Type 2 engagement, including external auditor coordination, control descriptions, evidence, deficiency tracking, and review of draft report sections.
Support state money transmitter (MTL) examinations by working with Legal, Compliance, and Finance on IT documentation, examiner requests, and tracking of IT findings.

Qualification

5+ years of experience in IT auditWorking knowledge of SOC 1 / SSAE 18Familiarity with PCAOB standardsClear communicationCISAExperience coordinating BC/DR testingFamiliarity with COSO 2013 and COBIT

Required

5+ years of experience in IT audit, SOX/ITGC testing, GRC, or technology compliance, in fintech, financial services, or public accounting.
Hands-on experience with ITGC testing across logical access, change management, and computer operations, and with documenting results in audit workpapers.
Working knowledge of SOC 1 / SSAE 18, including Type 2 reports, control descriptions, and deficiency management.
Familiarity with PCAOB standards.
Experience working with external auditors, regulators, or examiners and responding to their requests on deadline.
Strong organization and project management skills, with the ability to run several audit workstreams on different calendars at once.
Clear communication, and comfort holding technical control owners accountable for evidence and remediation.

Preferred

CISA, CIA, CPA, or CISSP certification.
Experience with state money transmitter examinations or FINRA IT and books-and-records requirements.
Experience coordinating BC/DR testing, including tabletop and failover exercises.
Experience supporting audit readiness during an acquisition or integration.
Familiarity with COSO 2013 and COBIT.
Experience with GRC or audit workflow tools, or with SQL or scripting for control testing.