> Markdown version of [/jobs/ext/3841200-security-engineer-grc](https://www.wearedevelopers.com/jobs/ext/3841200-security-engineer-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer - GRC

- **Company:** The Playlist LLC
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $150,000.0 - $170,000.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon S3, Software as a Service, Relational Databases, Disk Controller, PCI Data Security Standards, Retrieval-Augmented Generation, Large Language Models, Multi-Agent Systems, Agentic-AI, National Institute of Standards and Technology Cybersecurity Framework
- **Published:** October 20, 2026
- **Apply:** https://www.builtincolorado.com/job/senior-security-engineer-grc/11756724?handler=ApplyRedirect

## About the Role

* 6+ years of experience in security engineering, GRC, or compliance engineering, with direct hands-on work across multiple regulatory frameworks
 * Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53
 * Experience designing or maintaining control frameworks, crosswalks, or unified control architectures across multiple compliance standards
 * Hands-on experience managing evidence requirements and control implementation, not just documentation
 * Proficiency with compliance automation tooling (Optro, Drata, Vanta, Hyperproof, Anecdotes, or similar)
 * Ability to translate technical control design into clear implementation guidance for engineering and product teams
 * Experience building or operating agentic AI workflows (LLM-based pipelines, multi-agent systems, RAG architectures) in a production or near-production context

Nice to Have:

 * Hands-on experience with AWS services (Lambda, Step Functions, EventBridge, S3, Aurora/RDS) for building and maintaining compliance automation infrastructure
 * Experience supporting external audits or assessments as a primary technical contact
 * Exposure to multi-brand or post-acquisition control harmonization
 * Certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP (HITRUST), or PCI ISA
 * Experience in a SaaS or consumer marketplace environment

## Description

You'll be expected to act as a technical leader who can help mature our governance, risk, compliance, in a way that is durable, measurable, and embedded into how our systems operate day to day. Your time will center on two related workstreams. The first is building and maintaining Playlist's Master Control List, a live control architecture mapped across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53 that teams can use and navigate. The second is managing the full lifecycle of controls and evidence requirements as new standards are adopted, updated, or expanded to cover newly acquired brands.
You will

 * Design and build framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, using languages such as OSCAL as the translation layer to preserve framework-specific requirements while reducing duplicate audit burden
 * Own the Master Control List end-to-end, including control nomenclature, relational database architecture, evidence linkages, and the operational model for ongoing maintenance across Playlist's multi-brand footprint
 * Manage the full lifecycle of controls, evidence requirements, and implementation as new standards are adopted, requirements change, or acquired entities are brought into scope
 * Drive evidence automation in GRC tooling, building collection workflows that scale without turning every audit season into a manual sprint
 * Partner with Security Engineering, Legal, and Finance to validate that control design reflects how the business operates, translating compliance requirements into implementation guidance that engineering teams can act on
 * Design, build and maintain AI-powered GRC tooling, multi-agent pipelines for risk quantification, evidence automation, vendor risk assessment, and compliance monitoring using cloud native tools and APIs, so the team's analytical and operational capacity scales without scaling headcount
 * Identify rationalization opportunities across frameworks, so adding a new standard to the portfolio means incremental work, not starting from scratch

About the right team member

You think in systems, not checklists. You're the person who looks at five overlapping compliance frameworks and immediately starts sketching how they relate to each other, where the evidence reuse opportunities are, and what a sustainable architecture looks like long-term. You also see AI as a genuine lever, not a novelty, and you know how to wire agentic workflows into compliance programs in ways that hold up under audit scrutiny. You're equally comfortable whiteboarding a control schema, shipping a pipeline, and sitting with an auditor challenging a scope interpretation. You don't wait for someone to hand you the answer; you dig in, form a view, and bring it to leadership with the reasoning laid out. You're precise without being rigid, and you understand that compliance programs have to serve the business, not the other way around.
You'll thrive in this role with experience in, Maintain and mature Mozilla's ISMS, support ISO 27001 and SOC 2 Type 2 audits, author compliance narratives, track remediation, lead policy program, scale compliance for products, and partner with cross-functional teams to drive control ownership and audit readiness.
Top Skills: IsmsIso 27001Soc 2Soc 2 Trust Services CriteriaStatement Of Applicability (Soa)
Mozilla