> Markdown version of [/jobs/ext/2718582-grc-engineer](https://www.wearedevelopers.com/jobs/ext/2718582-grc-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Engineer - **Company:** Velera Solutions, LLC - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $110,100.0 - $143,100.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Microsoft Azure, Cyber Security, Databases, Continuous Integration, Data Masking, Persistent Data Structure, Database Security, DevOps, Identity and Access Management, Python (Programming Language), PCI Data Security Standards, Windows PowerShell, Policy as Code, Cloud Platform System, Delivery Pipeline, Infrastructure Automation Frameworks, Information Technology, Database Monitoring - **Published:** September 4, 2026 - **Apply:** https://startup.jobs/grc-engineer-remote-velera-solutions-llc-9766237 ## About the Role * Bachelors Degree in Computer Science, Cybersecurity, Management Information Systems (MIS), or equivalent experience * Exceptional background in database administration with deep knowledge of technical database compliance rules (PCI-DSS) requirements and knowledgable in Security GRC practices. * 10 + years as subject matter expert formerly in DBA roles and/or GRC Engineer * Strong program management skills in large complex organizations. * Propose solutions and implement effectively with minimal oversight. * Capable of building strong relationships with Security, Engineering, Product and other key stakeholders. * Ability to demonstrate GRC Engineering practices and use of AI solutions. * Previous GRC tooling for control automation experience highly desired. ## Description We are seeking a GRC Engineer to lead the transformation of our Technology Compliance program. In this role, you will replace manual audit testing with Compliance-as-Code (CaC), Policy-as-Code (PaC), and Continuous Control Monitoring (CCM) by embedding controls into the CI/CD pipelines to ensure systems remain continuously secure and compliant in our Azure cloud ecosystem. Leveraging your expertise, you will focus heavily on automating technical controls for data persistence layers, ensuring our infrastructure remains continuously compliant with SOC 1/2, NIST and PCI-DSS throughout a complex ecosystem. A Day in the Life * Compliance-as-Code: Embed security checks directly into development workflows and Infrastructure-as-Code (IaC) to block non-compliant deployments before they reach production. * Policy-as-Code (PaC) Engineering: Design, write, and maintain executable policies using Azure Policy, Open Policy Agent (OPA), or Rego to prevent non-compliant infrastructure deployments. * Continuous Control Monitoring (CCM): Build and maintain automated pipelines that continuously audit cloud environments, specialized database clusters, and storage systems against compliance baselines. * Database & Data Compliance: Design automated controls for database security, focusing on data-at-rest encryption, automated key rotation, data masking, database activity monitoring (DAM), and secure access controls (IAM/PIM). * CI/CD Security Integration: Inject automated compliance and configuration checks directly into our DevOps deployment pipelines to catch configuration drifts before code reaches production. * Audit Evidence Automation: Develop Python, PowerShell, or Go scripts to automatically gather, aggregate, and store point-in-time evidence for SOC, NIST, and PCI audits. * Remediation Automation: Solution to automatically remediate any potential control failures including Attestations * Risk Assessments: Identify, document, and quantify technical security risks, threats, and vulnerabilities, translating them into business-impact metrics for leadership. * Perform all other duties as assigned. ## Related Videos - [Valven Atlas: Engineering Intelligence That Delivers](https://www.wearedevelopers.com/videos/1660-valven-atlas-engineering-intelligence-that-delivers) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Kubernetes and Microservices with Multi-Model Databases](https://www.wearedevelopers.com/videos/382-kubernetes-and-microservices-with-multi-model-databases) - [Analytics in the Age of Agentic AI: A tour of ClickHouse and Langfuse](https://www.wearedevelopers.com/videos/100240-analytics-in-the-age-of-agentic-ai-a-tour-of-clickhouse-and-langfuse) - [Best practices: Building Enterprise Applications that leverage GenAI](https://www.wearedevelopers.com/videos/1513-best-practices-building-enterprise-applications-that-leverage-genai) - [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [How to Become an AI Engineer](https://www.wearedevelopers.com/magazine/331-how-to-become-an-ai-engineer)