Security Engineer II (GRC)

Job Summary

To support Governance, Risk & Compliance activities within the Cyber Security team, the full-time remote Security Engineer II (GRC) will manage security questionnaires, vendor risk assessments, and compliance initiatives across various frameworks while collaborating with multiple internal teams.

Key responsibilities

• Responding to RFPs and security questionnaires while coordinating with legal and product teams
• Conducting risk assessments, business impact analyses, and supporting internal and external audits
• Implementing and assessing security controls aligned with compliance frameworks such as HIPAA and SOC 2 Type II

Required qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field preferred
• 4-6 years of experience in Information Security Risk & Compliance / GRC
• Hands-on experience with compliance frameworks like HIPAA, SOC 2 Type II, and ISO 27001
• Familiarity with US federal and state security regulations, including FedRAMP and NIST SP 800-53
• Experience with vendor risk assessments and third-party risk management