Senior GRC Engineer (Remote, United States)

About Nearshore Cyber
Nearshore Cyber delivers cybersecurity work with teams in the United States and Mexico. This role is part of its GRC services business.

The role
GRC Engineers at Nearshore Cyber build the automation that keeps a governance, risk, and compliance program true: controls kept as code, evidence pulled from live systems, and monitoring that runs continuously instead of once a quarter. You will work with client security, platform, and audit teams on programs such as SOC 2, ISO/IEC 27001, NIST SP 800-53, FedRAMP, and CMMC. You lead the design of a client's GRC engineering program and the engineers who build it.

Location
Remote, United States. You must be authorized to work in the United States.

What you will do

• Lead the design of a client's GRC engineering program: controls as code, the evidence architecture, continuous monitoring, and posture reporting from live data.
• Set the boundary between controls inherited from cloud providers and platform teams, shared controls, and controls each system implements itself.
• Own audit and customer assurance from system-generated evidence, and state plainly what the evidence does and does not prove.
• Produce machine-readable security documentation, such as system security plans in OSCAL, generated from the source that describes the deployed system.
• Design AI-assisted GRC workflows with bounded access, a person accountable for each conclusion, and logged inputs and outputs.
• Mentor GRC engineers and advise client security and engineering leadership.

What you bring

• 7 or more years in GRC, audit, or security engineering, including 4 or more building compliance automation.
• Deep knowledge of two or more frameworks among SOC 2, ISO/IEC 27001, NIST SP 800-53, FedRAMP, and CMMC.
• Experience leading an audit or authorization through system-generated evidence.
• Architecture-level experience with AWS, Azure, or Google Cloud, and with infrastructure as code.
• The ability to explain technical risk to executives and auditors.

Nice to have

• OSCAL-based authorization packages.
• Quantitative risk analysis.
• Experience building a GRC engineering function.

Nearshore Cyber is an equal opportunity employer.