GRC Engineer

About the role

Clerk builds developer infrastructure for user identity and authentication. This role owns the end to end GRC program, including controls, evidence, audits, and responses, while hands on building integrations and tools that automate policy enforcement and evidence gathering.

What you'll do

• Own SOC 2 Type II and HIPAA end to end: scoping, control design, evidence, auditor walkthroughs, and remediation.
• Scope and lead our next framework, with ISO 27001 as the likely candidate, based on customer asks.
• Build and maintain integrations that feed our GRC platform from cloud providers, SaaS tools, and internal systems.
• Turn controls into continuous checks: policy as code, config drift detection, and a control failure pipeline from detection to closure.
• Run the vendor security review program, from intake to periodic re review.
• Own the security questionnaire and trust center workflow, and maintain the risk register with risk assessments.

What they're looking for

• 5+ years in security with demonstrated automation for a GRC or compliance program.
• Technical owner of at least one SOC 2 Type II or ISO 27001 audit and able to discuss improvements.
• You write code, and you use LLMs to get more done without lowering the bar.
• Hands on with a GRC platform API, not just its dashboard.
• Cloud IAM and configuration depth on at least one provider, GCP preferred.
• You can scope, prioritize, and ship without a lot of process around you.

For applicants in Nigeria

• The listing states worldwide eligibility, so applicants from Nigeria are eligible; confirm any country specific requirements during interview.
• The listing does not state a timezone requirement - confirm before interviewing.
• The listing does not specify contractor versus employee status - confirm during interview.
• The listing does not specify pay currency or range - confirm during interview.