> Markdown version of [/jobs/ext/4609107-security-engineer-grc](https://www.wearedevelopers.com/jobs/ext/4609107-security-engineer-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer (GRC)

- **Company:** Whatnot Inc.
- **Location:** New York, NY, United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Cyber Security, Github, Okta, Information Technology, Cloudflare, Terraform
- **Published:** November 6, 2026
- **Apply:** https://www.juju.com/job/28_25303_7d630374602798f79a1483a6b944b40d

## About the Role

Curious about who thrives at Whatnot? We've found that low ego, a growth mindset, and leaning into action and high impact goes a long way here.

As Our Governance, Risk, & Compliance Analyst You Should Have a Minimum Of 5+ Years Of Relevant Experience In Security Governance, Risk, And Compliance, Preferably In a Tech Startup Environment, Plus, * A Bachelor's degree in Computer Science, Information Security, or a related field.

 * The successful candidate will have a deep knowledge of security best practices and industry standards, such as ISO 27001, SOC2, PCI, and GDPR/ CCPA.
 * Experience at a Big 4 firm or similar reputable audit firm.
 * Experience in supporting complex third party audit projects in a cloud centric environment, with a strong aptitude to understand emerging technologies to ensure regulatory and compliance requirements are met.
 * Excellent written communication skills with the ability to document, communicate, and report security assessments as well as the status of the implementation and effectiveness of cybersecurity controls with product and business leaders.
 * Experience creating and running a security risk management program that adeptly balances security risks with business priorities.

## Description

Whatnot's Security GRC team is dedicated to building trust with regulators, customers, employees, and investors by demonstrating commitment to industry standards and continuous improvement. We defend and protect our users' data and information as if it were our own. As part of the Security GRC team, you can expect to be responsible for, * Reviewing and implementing secure configurations across various tools like Okta, Terraform, AWS, Lumos, Cloudflare, and Github.

 * Developing security requirements for partner teams and driving progress towards the execution of those requirements.
 * Preparing for and running our external security audits.
 * Shaping the strategic direction of the Security GRC team.
 * Leading our security risk management program to prioritize security risks and ensure proper mitigations are implemented.

Team members in this role are required to be within commuting distance of our Los Angeles, CA, San Francisco, CA, Seattle, WA or New York, NY hubs.