GRC Engineer I

The shape of it

In the posting’s own words

Building world-class financial services requires world-class security. As a GRC Engineer on the Trust team, you will work on high-impact cross-organization governance, risk, and compliance initiatives. You’d advocate for security across the company and scale Trust efforts while executing hands-on yourself.

What it asks for · 9

• Proven track record of cross-functional collaboration
• Experience leveraging AI to build automations to reduce manual workload
• Experience with security compliance frameworks and audits (e.g. SOC 2, PCI DSS, NIST, ISO 27001)
• Diligence and attention to detail in both process and content, strong written and verbal communication skills, with a talent for precise and clear articulation of complex concepts
• An aptitude for representing the needs of both your team, other stakeholders, and the overall business
• Ability to work in a fast-paced environment and address difficult situations in a professional manner
• Strong interpersonal skills and comfortable working across various functions
• Being innovative and providing “outside of the box” solutions
• Passion for having an owner’s mentality towards responsibilities

Also a plus

• Experience at technology, security, or risk focused companies
• Fluency with other GRC operational work and security support tasks such as policy revision, audit preparation and evidence collection, process design and improvement, customer/prospect/partner assurance, etc.
• Experience working in or with startups, especially during periods of growth
• Knowledge of fundamental security concepts and domains, in order to both assess the vendor’s security practices and also to define and document requirements on how we should safely use their products and/or services to mitigate relevant threats and how the implementation of a vendor may impact the security posture of the current environment

What the job covers

• Work under the guidance of seasoned GRC experts and gain exposure to a range of cross-functional programs and processes, both technical and business-centric.
• Enhance our GRC Engineering program, including building automations to improve compliance evidence collection, monitoring, and reporting dashboards.
• Conduct third party risk due diligence activities, namely identifying and assessing risks associated with existing and new vendor relationships prior to procurement and periodically thereafter, continuously monitoring for any relevant changes to the risk level or engagement scope. Where findings are identified during assessments, you would ensure plans of actions and check-ins are in place.
• Other Operational GRC Tasks
• Risk Register maintenance and reporting
• GTM Enablement support
• Tooling access requests
• Contractor request reviews
• Travel security request reviews
• Security compliance evidence collection
• Triaging of questions and requests for the GRC team (and learning to provide risk advisory over time!)
• Policy review and revision

Tools and skills named

Words the posting leans on

• security17×
• grc11×
• risk11×
• compliance7×
• trust7×
• experience5×
• audit4×
• engineering4×
• operational4×
• request4×
• requirements4×
• reviews4×
• vendor4×
• activities3×
• building3×
• business3×

Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.

More open at Brex

• Accountant Partnerships ManagerNew York, New York, United States
• Accountant Partnerships ManagerSan Francisco, California, United States
• Account Executive, Small BusinessSalt Lake City, Utah, United States
• Account Executive, Small BusinessSan Francisco, California, United States
• Account Executive, Small BusinessNew York, New York, United States
• Accounting Channel Partner ManagerSan Francisco, California, United States