Grc Controls Automation Engineer Jobs

WHAT IS BOX? Box (NYSE:BOX) is the leader in Intelligent Content Management. Our platform enables organizations to fuel collaboration, manage the entire content lifecycle, secure critical content, and transform business workflows with enterprise AI. We help companies thrive in the new AI-first era of business. Founded in 2005, Box simplifies work for leading global organizations, including JLL, Morgan Stanley, and Nationwide. Box is headquartered in Redwood City, CA, with offices across the United States, Europe, and Asia. By joining Box, you will have the unique opportunity to continue driving our platform forward. Content powers how we work. It’s the billions of files and information flowing across teams, departments, and key business processes every single day: contracts, invoices, employee records, financials, product specs, marketing assets, and more. Our mission is to bring intelligence to the world of content management and empower our customers to completely transform workflows across their organizations. With the combination of AI and enterprise content, the opportunity has never been greater to transform how the world works together and at Box you will be on the front lines of this massive shift. WHY BOX NEEDS YOU We are looking for an experienced and driven GRC Controls Automation Engineer who is looking to put their demonstrated awareness of regulatory standards to help bridge compliance requirements, technical infrastructure and engineering workflows. You will be focused on modernizing, designing, building and scaling frameworks that embed compliance directly into the software development (SDLC) process. As our GRC Controls Automation Engineer, you will play a key role building a scalable, efficient program and process using your technical leadership focusing on automation within Box. You will work with all functions of this fast-paced, rapidly changing business, and directly with key stakeholders to drive continuous improvement, com

WHAT IS BOX? Box (NYSE:BOX) is the leader in Intelligent Content Management. Our platform enables organizations to fuel collaboration, manage the entire content lifecycle, secure critical content, and transform business workflows with enterprise AI. We help companies thrive in the new AI-first era of business. Founded in 2005, Box simplifies work for leading global organizations, including JLL, Morgan Stanley, and Nationwide. Box is headquartered in Redwood City, CA, with offices across the United States, Europe, and Asia. By joining Box, you will have the unique opportunity to continue driving our platform forward. Content powers how we work. It’s the billions of files and information flowing across teams, departments, and key business processes every single day: contracts, invoices, employee records, financials, product specs, marketing assets, and more. Our mission is to bring intelligence to the world of content management and empower our customers to completely transform workflows across their organizations. With the combination of AI and enterprise content, the opportunity has never been greater to transform how the world works together and at Box you will be on the front lines of this massive shift. WHY BOX NEEDS YOU We are looking for an experienced and driven GRC Controls Automation Engineer who is looking to put their demonstrated awareness of regulatory standards to help bridge compliance requirements, technical infrastructure and engineering workflows. You will be focused on modernizing, designing, building and scaling frameworks that embed compliance directly into the software development (SDLC) process. As our GRC Controls Automation Engineer, you will play a key role building a scalable, efficient program and process using your technical leadership focusing on automation within Box. You will work with all functions of this fast-paced, rapidly changing business, and directly with key stakeholders to drive continuous improvement, com

Location: New York City or San Francisco - 4 days in office About the Role We are looking for a highly technical Senior Security Engineer who is passionate about protecting data across modern SaaS, cloud, endpoint, and analytics environments. This role is ideal for someone who enjoys solving complex data security challenges through engineering, automation, and AI rather than relying solely on commercial tools. You will help build, scale, and continuously evolve Sigma’s data security capabilities across SaaS applications, cloud platforms, endpoints, collaboration tools, AI systems, and data warehouses. You will be joining a dynamic and highly technical Security Engineering team at Sigma. This is a hands-on engineering role for builders, innovators, and problem-solvers who want to create scalable security solutions that protect the organization's most critical asset - data. What You'll Do Design, build, and maintain security platforms, services, APIs, automation, and internal tooling that protect Sigma's data across cloud, SaaS, endpoint, and analytics environments. Develop scalable solutions for data discovery, classification, governance, access controls, monitoring, and protection using modern engineering practices and automation. Build and mature capabilities around CASB, DLP, DSPM, SSPM, insider risk, and data access governance to reduce the risk of unauthorized access, sharing, or exposure of sensitive information. Build and maintain DLP controls and tooling across multiple cloud, OS environments and decentralized datasets, implementing and tuning prevention capabilities that protect against sophisticated data security incidents. Drive automation across DLP engineering and operations by leveraging LLMs, agentic AI, and an automation-first mindset to streamline workflows, reduce manual effort, and scale data protection coverage. Design and implement security controls across SaaS applications, collaboration platforms, endpoints, and business-critical

For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day. Smartsheet maintains certifications and attestations across SOC 2 Type II, the ISO 27001/27017/27701/22301 suite, HIPAA, and other commercial compliance frameworks—and the manual work of proving those controls quarter after quarter doesn't scale with the business. We're looking for a Sr. Security Engineer I to bring an engineering mindset to our commercial GRC program: automating control monitoring, building evidence pipelines, and reducing the audit-season scramble into a default state of readiness. You'll work hands-on with our GRC platform, cloud, and identity tooling to make control evidence collect itself wherever possible, and you'll partner closely with engineering teams to translate compliance requirements into technical control logic they can actually build against. This is a builder's role within GRC—less checklist administration, more systems thinking applied to compliance. Our approach is grounded in GRC Engineering principles: automate early and often, treat controls and their mappings as code, favor continuous assurance over periodic checks, and build compliance that engineers can consume as easily as they contribute to it. This role reports to the Senior Director, GRC Engineering and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer. You Will: Own control automation for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks: design and build automated evidence collection and continuous control monitoring across cloud, ident

Who We Are Verkada is transforming how organizations protect their people and places with an integrated, privacy-sensitive AI-powered platform that includes solutions for video security, access control, air quality sensors, alarms, intercoms, and visitor management. We’ve got serious momentum in the market: more than 30,000 customers (including 100+ of the Fortune 500), a $5.8B valuation , more than $1 billion in annualized bookings, and backing from CapitalG, Sequoia Capital, General Catalyst, Felicis Ventures, Next47 and more. Physical AI is one of the most consequential technology shifts of our time, and Verkada is at the center of it. You can look at all kinds of communities to see our platform’s impact in the world. It's the retailer that uses our agentic AI to deter theft before it happens. The warehouse that uses AI-powered alerts to make sure its team is protected on the floor with proper PPE. The school that’s alerted to a threat in real-time and triggers a lockdown in seconds, not minutes. We’re rapidly scaling this impact: today, more than 2 million Verkada devices are deployed across 170+ countries. About the Role Build and lead the GRCA function within Verkada’s Security Team. Manage risks, scale and meet Verkada’s growing compliance needs. Curate information provided to customers about Verkada’s security practices. You'll build scalable, automated programs that enable rapid business growth while maintaining customer trust. As Verkada expands globally with increasing enterprise customers, this role is critical to meeting sophisticated security and compliance expectations that directly impact revenue and risk management. What You'll Do Work cross functionally with Security, IT, Engineering, Product and Legal to provide guidance on security controls implementation including: effectiveness, implementation and automation Research, build and maintain tooling for testing and continuous monitoring of security controls across multiple platforms incl

Sr. GRC Engineer The Team + The Role Pendo's Information Security team protects the data entrusted to Pendo and helps ensure our products are built with security and privacy by design. The team spans Security Operations, Product Security, and Compliance and Risk. With a small team and broad scope, the work directly supports the security, resilience, and trust of Pendo's products and operations. The Sr. GRC Engineer is an AI-first technical leader who helps drive the evolution of Pendo's governance, risk, and compliance program. This role independently leads complex compliance, risk, and incident-response work while identifying program maturity gaps, translating security risk into business terms, and contributing to security roadmap and investment decisions. Success means building durable controls and programs that reduce risk and operational friction, not simply completing audits. This role is based in our Raleigh office. What this looks like day-to-day AI-driven compliance and operations acceleration: Use AI to accelerate audit evidence preparation, policy documentation, control testing workflows, and regulatory research. Evaluate GRC platform automation capabilities and integrate AI tooling where it reduces manual overhead, then document and share effective approaches with the team. Security program strategy and roadmap: Identify maturity gaps across compliance and security operations and translate them into prioritized roadmap recommendations grounded in business risk. Contribute to security investment discussions, clarify tradeoffs between coverage, cost, and risk, and anticipate emerging regulatory requirements before they become audit findings. Compliance program ownership: Own one or more regulatory compliance programs end-to-end, including SOC 2 Type II, ISO 27001/42001, PCI-DSS, GovRAMP, or FedRAMP. Lead control design, evidence collection, auditor relationships, and remediation tracking to maintain effective and durable compliance programs. Risk assessment

Location: New York City or San Francisco - 4 days in office About the Role We are looking for a highly technical Senior Security Engineer who thrives on building security capabilities from the ground up. This role is ideal for someone who enjoys solving complex security challenges through engineering, automation, and AI rather than relying solely on commercial tools. You will help build, scale, and continuously evolve the next generation of security capabilities across our cloud-native SaaS platform, with a strong focus on AI security, automation, and scalable security operations. We are looking for engineers who enjoy solving security problems across multiple domains rather than specializing exclusively in a single area. You will join a highly technical Security Engineering team that values innovation, ownership, and building scalable security solutions. This is a hands-on engineering role for builders, innovators, and problem-solvers who want to create security solutions that operate at scale. What You’ll Do Security Engineering Design, build, and maintain security platforms, services, APIs, automation, and internal tooling. Develop solutions that streamline Cloud vulnerability management, Network Security, Detection engineering, Incident response, access governance, and security operations. Use software engineering principles to build detections-as-code, security workflows, internal platforms, and scalable security services that enable the organization to move faster while remaining secure. Leverage AI extensively to accelerate investigations, automate workflows, improve decision making, and reduce operational overhead. AI & LLM Security Design and implement security controls for AI applications, LLM-powered services, agents, and AI development workflows. Build guardrails and security tooling to identify and mitigate risks such as prompt injection, data leakage, model misuse, excessive permissions, insecure plugins, and unsafe AI interacti

Every day, tens of millions of people come to Roblox to explore, create, play, learn, and connect with friends in 3D immersive digital experiences– all created by our global community of developers and creators. At Roblox, we’re building the tools and platform that empower our community to bring any experience that they can imagine to life. Our vision is to reimagine the way people come together, from anywhere in the world, and on any device. We’re on a mission to connect a billion people with optimism and civility, and looking for amazing talent to help us get there. A career at Roblox means you’ll be working to shape the future of human interaction, solving unique technical challenges at scale, and helping to create safer, more civil shared experiences for everyone. As a member of the Roblox Security Governance, Risk, and Compliance (GRC) team, you will play a key role in supporting the Security team’s mission. The GRC team is at the heart of Roblox's security organization — empowering every builder to make risk-informed decisions by establishing a portfolio of governing policies and standards, a repeatable and scalable method of assessing and quantifying risk, and a formal oversight process for GRC capabilities across Roblox. Our program takes a balanced, "right-sized" approach to security governance — combining qualitative and quantitative risk management methodologies, including Factor Analysis of Information Risk (FAIR), to assess and prioritize the security risks that matter most to Roblox. GRC partners closely with Engineering, Legal, Finance, and leadership — including providing regular reporting to the Board of Directors and the Audit & Compliance Committee — to ensure that security risk is visible, well-understood, and actioned appropriately. The team is in an exciting phase of growth and innovation. We are using engineering to drive automation across risk management, policy lifecycle management, supply chain risk, AI risk, and controls pr

Strength in Trust OneTrust’s mission is to enable innovation through the responsible use of data and AI. We believe that ensuring data is trusted shouldn’t slow teams down—it should accelerate what’s possible. This led us to develop the first technology platform for responsible data use in 2016. Today, with AI representing the latest and most impactful expansion of data yet, OneTrust is once again redefining what responsible innovation looks like. OneTrust, the AI‑Ready Governance Platform™, unifies regulatory intelligence, automation, and connected governance workflows so businesses can continue to move at the speed of AI while ensuring good governance to prevent data misuse at scale. Trusted by thousands of organizations worldwide, OneTrust is shaping the future where trusted data becomes a transformative force for business and society. The Challenge We are looking for a dynamic Senior Information Security GRC Analyst to support IT and InfoSec by performing various governance, risk, and compliance activities as part of the OneTrust InfoSec GRC team. Your Mission Customer Security Assurance & Questionnaires Own a high volume of end-to-end completion of customer security questionnaires (CAQs) , RFP security sections, and other assurance artifacts (e.g., SIG, CAIQ, custom questionnaires). Provide accurate, consistent, and defensible responses by leveraging internal evidence repositories (SOC reports, ISO certificates, policies, standards, diagrams, pen test summaries, etc.). Partner with internal stakeholders (Sales, Marketing, Customer Success, Security, Engineering, Privacy, Legal, Compliance, Product) to validate responses and resolve gaps. Customer Engagement & Security Discussions Meet with customers and prospects to explain security controls, risk posture, and compliance commitments . Present security topics with confidence and clarity—tailoring depth for technical and non-technical audiences. Support Sales and Customer Success by addressin

Every day, tens of millions of people come to Roblox to explore, create, play, learn, and connect with friends in 3D immersive digital experiences– all created by our global community of developers and creators. At Roblox, we’re building the tools and platform that empower our community to bring any experience that they can imagine to life. Our vision is to reimagine the way people come together, from anywhere in the world, and on any device. We’re on a mission to connect a billion people with optimism and civility, and looking for amazing talent to help us get there. A career at Roblox means you’ll be working to shape the future of human interaction, solving unique technical challenges at scale, and helping to create safer, more civil shared experiences for everyone. As a member of the Roblox Security Governance, Risk, and Compliance (GRC) team, you will play a key role in supporting the Security team’s mission. The GRC team is at the heart of Roblox's security organization — empowering every builder to make risk-informed decisions by establishing a portfolio of governing policies and standards, a repeatable and scalable method of assessing and quantifying risk, and a formal oversight process for GRC capabilities across Roblox. Our program takes a balanced, "right-sized" approach to security governance — combining qualitative and quantitative risk management methodologies, including Factor Analysis of Information Risk (FAIR), to assess and prioritize the security risks that matter most to Roblox. GRC partners closely with Engineering, Legal, Finance, and leadership — including providing regular reporting to the Board of Directors and the Audit & Compliance Committee — to ensure that security risk is visible, well-understood, and actioned appropriately. The team is in an exciting phase of growth and innovation. We are using engineering to drive automation across risk management, policy lifecycle management, supply chain risk, AI risk, and controls pr

As the Engineering Manager for Commercial Audit, you will lead a high-performing team responsible for scaling Datadog’s security and compliance posture through automation, tooling, and engineering excellence. Our GRC (Governance, Risk, and Compliance) function is a critical partner to the broader Security and Engineering organizations, ensuring that Datadog not only meets rigorous global regulatory standards but does so in a way that is efficient, scalable, and integrated into our cloud-native infrastructure. You will manage a team of engineers and analysts who are transitioning to a GRC engineering direction to treat compliance as a software problem, leveraging AI, custom tooling, CI/CD pipelines, and cloud-native services to turn complex regulatory requirements into actionable, automated controls. You will lead the strategy, roadmap, and execution of Datadog’s Commercial Audit initiatives. This is a high-impact leadership role where you will grow a team of engineers and analysts responsible for directly maintaining our compliance programs and related audits (e.g., SOC2, PCI, HIPAA, ISO) while looking to improve efficiency and effectiveness through platforms and tooling. You will act as a bridge between technical engineering, legal, and compliance, enabling the organization to move fast while maintaining a secure and compliant environment. You will champion a culture of "compliance-as-code," identifying opportunities to automate evidence collection, streamline control testing, and reduce manual toil for both your team and our partner engineering teams. At Datadog, we place value in our office culture - the relationships and collaboration it builds, and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Lead the strategy, roadmap, and execution of Datadog’s commercial security compliance efforts, shifting from manual audit processes to automated, scalable

About Druva Druva is the resilience foundation for the AI enterprise, helping organizations secure and recover from connected risk across data, cyber, identity, and AI. The Resilience Cloud is a fully managed, cloud-native SaaS platform that delivers air-gapped and immutable protection across cloud, SaaS, on-premises, endpoint, and edge environments. Powered by Dru MetaGraph, Druva’s graph-powered intelligence layer, the platform connects critical business context so customers can understand risk, respond faster, recover cleanly, and govern data with greater confidence. Trusted by nearly 7,500 customers, including 75 of the Fortune 500, Druva helps safeguard the critical information and systems businesses depend on in an increasingly connected world. Visit druva.com and follow us on LinkedIn , X and Facebook . Experience Level: 6–10 Years Domain: Product Security / AppSec / DevSecOps / AI Security / AI-First SDLC Role Summary We are looking for a hands-on Senior Staff Product Security Engineer to join and lead initiatives across our product security landscape. In this role, you will redefine modern Product Security by architecting an AI-first SDLC seamlessly integrating traditional AppSec with advanced AI security practices, automating shift-left pipelines, conducting rigorous threat models for core services and complex AI architectures, and leveraging cutting-edge AI tools to accelerate vulnerability remediation. You will partner directly with engineering leadership, Information Security, GRC, BuildOps, and DevOps teams to secure our SaaS products and safely enable cutting-edge agentic features. Role & Responsibilities AI-First SDLC & Shift-Left Automation: Architect and embed AI-driven security controls (SAST, DAST, SCA, Container, Secrets Detection) directly into CI/CD build pipelines and developer workflows, establishing an intelligent, highly automated AI-first SDLC. Operational & Strategic AI Security: Lev

Gong harnesses the power of AI to transform how revenue teams win. The Gong Revenue AI Operating System unifies data, insights, and workflows into a single, trusted system that observes, guides, and acts alongside the world’s most successful revenue teams. Powered by the Gong Revenue Graph, AI-powered intelligence, specialized agents, and trusted applications, Gong helps more than 5,000 companies around the world deeply understand their teams and customers, automate critical sales workflows, and close more deals with less effort. For more information, visit www.gong.io. At Gong, you will join a company built on innovative products, ambitious goals, and passionate people. We are shaping the future of revenue intelligence and we want people who are excited to build what comes next. You will work with a team that dreams big, moves fast, and cares deeply about the craft and about each other. Here, transparency and trust are core to how we operate, and every person has the opportunity to make a visible impact. If you want to grow, stretch, and do work that truly matters, Gong is the place to do the best work of your career. We’re looking for an experienced, multidisciplinary Security Engineer with a strong technical foundation and the ability to learn and own new technologies and domains from the ground up.You’ll join Corporate Security Engineering within Gong’s Cyber Defense organization, You’ll design, implement, and mature the security controls that protect Gong’s business applications, workforce, and corporate environment. You’ll work closely with Cyber Defense, IT, DRE, R&D, People, Legal, and GRC to embed security controls at scale. Our strategy is AI-first and built on identity-centric controls, Zero Trust principles, and scalable automation. You’ll Own The security posture of Gong’s corporate technology stack, including AI security, identity, DLP and insider risk, EDR, MDM, browser security, SSPM/CASB, network security, and email and collaboration security. Z

For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day. The Sr. Security Engineer I is a critical technical role focused on deal acceleration, platform security evangelism, and the development of security features and capabilities that enhance our customer security and governance capabilities. You will support security and compliance during sales motions and bridge communication between complex customer security requirements and technical product engineering. You will work directly with customer security leaders (security engineers through CISOs) to communicate and clarify product security posture and controls results (such as pen test results), and will work with Smartsheet engineering to build security features that meet real-world customer requirements. You will display product understanding through highly customized presentation demonstrations to customers and at conferences and events. This role reports to the Senior Director, GRC Engineering and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer. You Will: Serve as a trusted advisor to enterprise customers, CISOs, CIOs, and guiding them on Smartsheet security, compliance, and risk management. Evaluate customer infrastructure diagrams and data flows, and how Smartsheet can help with automation without compromising security. Present scanning results (NIST 800-53 gaps, vulnerability scans, DAST/pen test, IaC scans) to customers including walking through remediations. Help customers interpret scan results and develop deviation rationales fo

The Cyber Deployment Manager partners with customers throughout the full lifecycle—from technical discovery and solution design through implementation, deployment, and adoption. You’ll work closely with Sales and Solutions Engineering during the pre-sales process to understand customer security priorities, assess technical requirements, develop solution architectures, and support demonstrations, workshops, and proofs of concept. After a customer commits, you’ll remain engaged as the technical deployment lead, translating the proposed solution into a production-ready implementation. You’ll guide integrations, establish success criteria, manage technical risks, and help customers operationalize AI across security workflows such as secure code review, vulnerability management, threat detection, incident response, SOC operations, and GRC automation. In this role, you will: Lead technical discovery with security executives, practitioners, architects, and engineering teams. Partner with Sales and Solutions Engineering on solution design, demonstrations, workshops, technical validation, and proofs of concept. Translate customer requirements into clear architectures, deployment plans, success criteria, and implementation milestones. Own the transition from pre-sales solution design into post-sales deployment and adoption. Serve as the primary technical partner during implementation, coordinating customer stakeholders and internal Product, Engineering, Security, and GTM teams. Build and troubleshoot integrations involving APIs, agents, security tools, cloud platforms, data sources, and enterprise workflows. Identify deployment risks, technical blockers, and product gaps, and drive them toward resolution. Help customers establish evaluation frameworks, governance controls, guardrails, monitoring, and human-review processes. Measure adoption and business impact, ensuring deployed solutions deliver meaningful security outcomes. Turn successful customer deployments into reusable