GRC Engineer I (Special Programs)

About Workstreet

At Workstreet, we’re on an exciting journey to help businesses scale securely by designing and implementing cutting-edge security and compliance programs. As a fast-growing startup, we specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP. We empower companies to meet regulatory requirements and enhance their cybersecurity posture from day one.

Get to know the Special Programs Team

The Special Programs team delivers high-impact, fast-paced services that help organizations accelerate their compliance journey. Unlike our standard offerings, Special Programs are purpose-built engagements designed to solve specific customer challenges, from establishing a compliance foundation in 30 days to migrating organizations onto new GRC platforms, supporting audits, and delivering other specialized compliance services.

For many customers, Special Programs represent their first experience working with Workstreet. Because of that, we are laser-focused on speed, quality, and an exceptional customer experience that builds trust from day one. We support hundreds of organizations, from early-stage startups to global enterprises, across nearly every industry.

The Opportunity

Workstreet is seeking a highly motivated, client-focused GRC Engineer to join our fast-growing team. Built around client relationship excellence, this role focuses on delivering exceptional client experiences, cultivating trust, and driving program outcomes while managing accounts and overseeing a pod of analysts across frameworks such as SOC 2, ISO 27001, and NIST CSF.

The successful candidate will integrate quickly into the organization and manage active client accounts within their first 15 days. You will serve as the dedicated primary point of contact for a portfolio of accounts, guiding engagements end-to-end, resolving escalations with composure and urgency, and ensuring every client interaction reflects the highest standard of service.

What you'll do

Execute end-to-end client compliance initiatives - assist in implementing and maintaining client security compliance programs aligned with SOC 2, ISO 27001, and regulatory standards.

Maintain policy and evidence repositories - author and update corporate security policies, standard operating procedures, and control evidence to support formal audits and assessments.

Identify and mitigate technical risks - partner with cross-functional technical teams to track, evaluate, and remediate cybersecurity risks and control gaps.

Manage project deliverables and timelines - track compliance milestones, evidence gathering, and task execution across concurrent client engagements under senior guidance.

Drive direct client communications - engage directly with client stakeholders via email, chat, and video calls to gather evidence, clarify control requirements, and share updates.

Perform control testing and readiness reviews - conduct structured control evaluations and readiness checks to maintain continuous compliance alignment.

Partner cross-functionally on remediation - collaborate with internal IT, security, and operations teams to execute corrective action plans and improve compliance posture.

Contribute to operational process scaling - receive mentorship from senior leaders while updating delivery templates, playbooks, and standard operating procedures.

Who you are

Direct client engagement operator - proven ability to communicate directly with U.S. clients, maintaining professionalism and executive care across all touchpoints.

Multi-project GRC operator - bring strong organizational discipline to manage multiple cybersecurity compliance engagements simultaneously without losing velocity.

Technical compliance practitioner - hands-on execution experience across SOC 2, ISO 27001, or NIST CSF frameworks within tech-focused cybersecurity environments.

Policy lifecycle architect - practical familiarity authoring, rolling out, and enforcing enterprise cybersecurity policies and control benchmarks.

High-velocity startup operator - thrives in fast-paced startup settings, adapting quickly to shifting priorities and dynamic client challenges.

Exceptional technical communicator - possesses outstanding written and verbal English communication skills suited for executive and technical interactions.

What help you succeed

Compliance automation platform mastery - practical exposure utilizing automated compliance solutions such as Vanta or similar GRC platforms.

Expanded regulatory framework knowledge - practical familiarity with additional regulatory frameworks including GDPR, HIPAA, or PCI DSS.

Active industry certifications - credentialed practitioner holding recognized certifications such as ISO 27001 Lead Implementer, CISA, or Security+.

What we offer

Career Development

Clear path with mentorship and training opportunities.

Role-Related Training

Reimbursement for the successful completion of approved training and certification courses relevant to your current role.

Competitive Compensation

A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.

Growth Opportunity

Early-stage company with significant room for career advancement.

Remote-First Culture

Flexibility to work from anywhere while collaborating with a global team.

What you'll need to thrive

Excellent written and verbal English communication skills, with the ability to engage confidently with candidates, hiring managers, and business leaders across global teams.

A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, virtual interviews, and uninterrupted collaboration.

Commitment to working a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time (ET) to effectively collaborate with team members, stakeholders, and cross-functional partner