> Markdown version of [/jobs/ext/4292835-grc-engineer](https://www.wearedevelopers.com/jobs/ext/4292835-grc-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# GRC Engineer

- **Company:** Seven AI, Inc.
- **Location:** Boston, MA, United States
- **Experience:** Expert
- **Salary:** $130,000.0 - $180,000.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Software as a Service, Python (Programming Language), Automation of Marketing, SQL Databases, Scripting
- **Published:** October 25, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=c75ec1265a6668a4

## About the Role

* 5+ years of experience in GRC, compliance, or security risk.
 * Hands-on experience supporting SOC 2 audits, and working knowledge of ISO 27001, ISO 42001 and FedRAMP.
 * Experience running third-party risk management, including vendor assessments.
 * Experience with a compliance automation platform such as Scytale, Vanta, or Drata.
 * Experience running internal audits or control testing.
 * Comfort talking with customers and vendors about security, in plain language.
 * Strong project tracking habits, and a track record of keeping stakeholders informed.
 * Practical experience using AI tools to speed up your own work, and curiosity about what else can be automated.
 * A doer's mindset. You spot what needs to happen and start, without waiting to be asked.

Nice to Have

 * Bachelors or Masters degree
 * Hands-on experience with SaaS compliance automation platforms.
 * Experience in a security vendor or fast-growing startup, especially in customer-facing security assurance.
 * Exposure to AI governance, such as ISO 42001 or the NIST AI RMF.
 * Scripting skills, such as Python or SQL, to automate evidence collection and reporting.
 * Certifications such as CISA, CRISC, CISSP, or ISO 27001 Lead Auditor or Lead Implementer.

## Description

* Manage and maintain our compliance program through our compliance automation platform. Keeping controls, evidence, and integrations current.
 * Prepare for and support SOC 2, ISO, and FedRAMP audits, as well as assessments supporting other regulatory frameworks, as required by the business and our customers.
 * Run internal audits. Test controls, document findings, and track remediation through to closure.
 * Run third-party risk management. Assess vendors, review their security documentation, and maintain the vendor risk register.
 * Work with customers on security questionnaires, compliance documentation, and assurance requests.
 * Work with vendors to collect evidence and close gaps.
 * Keep internal stakeholders informed on GRC projects and initiatives, with clear status tracking from start to finish.
 * Use AI to automate repeatable GRC work, such as evidence collection, questionnaire responses, and control testing.
 * Keep policies, control descriptions, and risk records accurate as frameworks and our business change.