Senior Security Engineer GRC Engineering

Overview

Senior Security Engineer GRC Engineering

One Identity · Information Security, Customer Trust & Assurance

Senior individual contributor · India · Reports to the Director of Information Security

Why this role exists

One Identity holds certifications because customers require them before they buy, and the ones ahead open international regulatory markets. This role builds the centralized common controls framework, with ISO 27001 and SOC 2 as the base, that each addition maps into. Evidence comes from continuous monitoring, an audit request is answered with a query rather than an email thread, and the next market is a mapping exercise that unlocks revenue opportunities for the company.

We run hosted services in Azure and AWS and ship software customers deploy in their own datacenters, so the evidence sits in cloud control planes, build pipelines, identity systems, and endpoints. Compliance analysts run the assessments and own questionnaire response. This seat builds the systems they draw from: an answer to an auditor and an answer to a customer should come from the same facts.

We're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this seat owns the compliance engineering program. Scope comes from what you ship and from what the auditors accept.

What you'll do

Make evidence a query

Own continuous control monitoring end to end: integrations into the identity provider, cloud control planes, code repositories, endpoint management, and ticketing, with alerting and escalation wired in, so a control that degrades reaches its owner with the context to act and the monitoring confirms the fix.

Build the centralized common controls framework and the artifact layer on it: ISO 27001 and SOC 2 as the base, each new framework mapped against it, and evidence captured, timestamped, and indexed against the control that requires it. A control tested once answers every framework referencing it, and an audit-ready package assembles on demand.

Hold the platform to its own standard. The evidence system sits inside audit scope, logs its own activity, and operates within the controls it measures.

Put controls in code

Write control validation as code: checks that programmatically test whether a control is implemented, with output an auditor accepts and an engineer can act on. Where a failed check traces to code, the correction arrives as a pull request against the pipeline, policy, or configuration that produced it. PRs, not tickets.

Partner with the principal infrastructure seat on policy as code. They set the enforcement architecture inside the cloud platform; you make sure every enforced policy emits the evidence the frameworks require.

Decide where agentic workflows belong in compliance engineering. Control mapping, evidence classification, and first-pass validation are tractable now; attestation is a human act. You set where automation acts, where it recommends, and how its output is verified. The same discipline applies to your own build: automation shares the lift, and nothing ships unverified.

Own the program

Own the program's direction. Which frameworks come next, which controls get automated first, and where the engineering effort goes: those calls are this seat's to make and to defend.

Advance the program's metrics: control health, coverage against the framework map, remediation velocity, and the trend lines leadership steers by, produced from the same data the auditors draw on.

Integrate cyber risk management into the platform: the risk register and exception handling run on the same control telemetry, automated wherever the workflow allows, with the hands-on remainder worked alongside the compliance analysts. An acceptance carries an owner and an expiry.

Own asset prioritization as the base layer of the program: which systems and data matter most, kept current through automation, feeding risk decisions, control coverage, and remediation order.

Front the technical side of audits: walk an assessor through how a control is implemented and how its evidence was produced, in language that holds up under the follow-up question.

What we're looking for

Required

Six or more years across compliance program leadership and security or compliance engineering, with time spent on both the framework side and the build side. Equivalent depth counts.

Depth in at least one of two forms: a major framework carried through assessment under your leadership, FedRAMP or comparable, from readiness through certification or authorization; or GRC engineering you owned end to end, with control telemetry, continuous monitoring, and evidence automation built and run under your direction.

Strategic framework design: control mapping across frameworks you shaped yourself, and a defensible view on how a common controls framework should be structured.

Engineering depth you've used recently: Python and API integration work of your own, and hands-on building with AI in the loop within the last six months. We'll ask what you built, when, and how you verified what the tooling produced.

The three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.

Also matters: framework fluency across ISO 27001 and SOC 2, and familiarity with FedRAMP 20x, where machine-validated Key Security Indicators are the assessment mechanism; NIS2, DORA, and PCI DSS and where they surface in customer requirements; policy-as-code frameworks and a view on where enforcement belongs; enough Azure and AWS depth to know where the evidence lives; a compliance automation platform and the judgment to know what to build around it; running an audit calendar and an assessor relationship without drama; writing an auditor and an engineer can both act on.

Helpful

time on the assessor's side of the table; IRAP or another regime outside t