Clerk Senior GRC Engineer responsible for owning SOC 2 Type II and HIPAA compliance programs and building automation for GRC. Role includes leading audits, building integrations, and embedding compliance into SDLC.
Responsibilities
Own SOC 2 Type II and HIPAA end to end: scoping, control design, evidence, auditor walkthroughs, and remediation
Scope and lead our next framework (ISO 27001 is the likely candidate) based on what customers actually ask for
Build and maintain the integrations that feed our GRC platform from our cloud providers, SaaS tools, and internal systems
Turn controls into continuous checks: policy-as-code, config drift detection, and a control-failure pipeline from detection to closure
Run the vendor security review program, from intake to periodic re-review
Own the security questionnaire and trust center workflow
Maintain the risk register and run risk assessments that produce documented decisions
Embed compliance requirements into the SDLC and change management so they're enforced by tooling, not by reminders
Reduce the number of things a human has to do to pass an audit every quarter
Qualification
5+ years in securityYou write codeHands-on with a GRC platform's APIClear writerExperience at an all-remote companyExperience at a developer-tools company
Required
5+ years in security, with demonstrated experience building automation for a GRC or compliance program
You've been the technical owner of at least one SOC 2 Type II or ISO 27001 audit and can tell us what you would do differently
You write code, and you use LLMs to get more done without lowering the bar
Hands-on with a GRC platform's API, not just its dashboard
Cloud IAM and configuration depth on at least one provider, GCP preferred
You can decide what evidence is sufficient and defend an automated test to an auditor
Comfortable being one of a few security engineers; you can scope, prioritize, and ship without a lot of process around you
Clear writer: policies, control narratives, and questionnaire answers are read by customers, so they have to be good
Preferred
Experience at an all-remote company
Shipped LLM or agentic workflows in production for compliance work
