> Markdown version of [/jobs/ext/2147761-principal-grc-business-engineer](https://www.wearedevelopers.com/jobs/ext/2147761-principal-grc-business-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal GRC Business Engineer - **Company:** Palo Alto Networks - **Location:** Santa Clara, CA, United States - **Experience:** Expert - **Salary:** $167,600.0 - $271,150.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Microsoft Azure, Software as a Service, Cyber Security, PCI Data Security Standards, Smartsuite, Multi-Cloud, Information Technology, RSA Archer Platform - **Published:** August 20, 2026 - **Apply:** https://dejobs.org/x/x/C70B60AAB8B748238B4778D7092856F1/job/ ## About the Role * 10+ years of experience in Information Security or IT Risk, with at least 6+ years explicitly focused on GRC, security governance, and enterprise risk engineering in global environments (Please confirm this experience requirement). * Bachelor's or Master's degree in Computer Science, Cybersecurity, Management Information Systems, or equivalent practical experience. * Active certification in CISSP, CRISC, CISM, or CISA required. * Deep working knowledge of ISO 27001/2, NIST SP 800-53, NIST CSF, SOC 2 Type II, PCI-DSS, GDPR, and enterprise risk frameworks. * Proven track record of developing and managing risk management processes, including risk quantification and executive-level reporting. * Hands-on experience developing requirements from a GRC perspective and partnering with automation teams to implement GRC platforms. * Hands-on experience configuring GRC tools at an application level to implement workflows, routing rules, and in-app automations. * Experience working across multi-cloud infrastructure (AWS, Azure, or GCP) and modern enterprise architecture. * Exceptional communication skills with a demonstrated ability to partner with and influence cross-functional stakeholders. * Adept at navigating ambiguity and proactively developing effective solutions for complex challenges. Preferred Qualifications * Active certification in CCSP or CIPP. * Hands-on experience developing or assessing AI governance frameworks, such as NIST AI RMF or ISO 42001. ## Description We are seeking a Principal InfoSec GRC Business Engineer to architect, execute, and mature our Global Governance, Risk, and Compliance programs. In this senior role, you will bridge technical security engineering, enterprise risk management, and business operations by designing global governance frameworks and scalable risk assessment methodologies. You will partner with key stakeholders to craft actionable security policies and standards. Leveraging an engineering mindset, you will use AI, automation, and continuous control monitoring to embed security seamlessly into product, platform, and enterprise operations., * Design and scale the global GRC vision to align security governance with enterprise goals and regulatory mandates. * Partner with senior leaders across Information Security, Legal, and Product Engineering to align risk tolerance with business objectives. * Lead the drafting, maintenance, rollout, and annual review of Information Security policies, standards, procedures, and guidelines. * Translate complex regulatory and security frameworks into clear, actionable security-focused requirements. * Architect and refine quantitative and qualitative risk assessment methodologies for cloud, SaaS, and hybrid environments. * Lead end-to-end technical security risk evaluations for business-critical applications, infrastructure, and processes. * Design and manage executive-level risk reporting to provide visibility into risk posture and drive risk reduction. * Lead the implementation, optimization, and continuous improvement of enterprise GRC platforms and risk management tools. * Design and implement test plans and policy-as-code to enable automated evidence collection and real-time control testing. * Redesign manual risk and compliance processes into scalable, automated workflows to reduce operational friction. ## Related Videos - [How to Stop Your Agents From Going Rogue - Arnav Gupta](https://www.wearedevelopers.com/videos/2152-how-to-stop-your-agents-from-going-rogue-arnav-gupta) - [The Open-source Java SDK for Multi-Cloud Development - Sandeep Pal](https://www.wearedevelopers.com/videos/2113-the-open-source-java-sdk-for-multi-cloud-development-sandeep-pal) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Beyond GPT: Building Unified GenAI Platforms for the Enterprise of Tomorrow](https://www.wearedevelopers.com/videos/1525-beyond-gpt-building-unified-genai-platforms-for-the-enterprise-of-tomorrow) - [Leverage Cloud Computing Benefits with Serverless Multi-Cloud ML ](https://www.wearedevelopers.com/videos/78-leverage-cloud-computing-benefits-with-serverless-multi-cloud-ml) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Everything a Developer Needs to Know About MCP with Neo4j](https://www.wearedevelopers.com/magazine/604-everything-a-developer-needs-to-know-about-mcp-with-neo4j) - [Got AI ideas but no money? Here are 10 free ways to level up your AI skills with Google Cloud](https://www.wearedevelopers.com/magazine/600-got-ai-ideas-but-no-money-here-are-10-free-ways-to-level-up-your-ai-skills-with-google-cloud) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere) - [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)