GRC Engineer (Remote, Mexico)

About Nearshore Cyber
Nearshore Cyber delivers cybersecurity work with teams in the United States and Mexico. This role is part of its GRC services business.

The role
GRC Engineers at Nearshore Cyber build the automation that keeps a governance, risk, and compliance program true: controls kept as code, evidence pulled from live systems, and monitoring that runs continuously instead of once a quarter. You will work with client security, platform, and audit teams on programs such as SOC 2, ISO/IEC 27001, NIST SP 800-53, FedRAMP, and CMMC. You design and build the controls-as-code, evidence pipelines, and continuous control monitoring that a client's compliance program runs on.

Location
Remote, Mexico. You must be authorized to work in Mexico. Fluent Spanish and professional working English, written and spoken, are required: you will work with clients in the United States.

What you will do

• Design and build evidence pipelines and continuous control monitoring, including how each check treats a failure, a tolerated deviation, and missing data.
• Translate written policies and framework requirements into testable control specifications with a named system of record, pass condition, frequency, and owner.
• Write and test policy-as-code, and decide where each rule is enforced in the delivery path: blocking before deployment, warning, or detecting after deployment.
• Implement control exceptions as approved, time-bound records that the automated checks read.
• Maintain a unified control library mapped across frameworks, and identify where a mapping overstates coverage.
• Integrate a compliance automation platform with internal systems, and build custom checks where a built-in test does not match how a control actually operates.

What you bring

• 4 or more years across GRC, audit, and engineering, including 2 or more building compliance automation.
• Production-quality Python and SQL.
• Terraform or similar infrastructure as code, and CI/CD pipelines.
• Strong knowledge of SOC 2 and ISO/IEC 27001 or NIST SP 800-53, including how auditors evaluate evidence.
• Hands-on experience with security and configuration services in AWS, Azure, or Google Cloud.

Nice to have

• OSCAL or other machine-readable control formats.
• FedRAMP or CMMC programs.
• AI-assisted workflows for evidence analysis or control testing.

Nearshore Cyber is an equal opportunity employer.