← All roles

GRC Engineer

Clerk· Security
Apply on company site
RemoteFull-timePosted 3w ago

About the role

Senior GRC Engineer to own and automate Clerk's governance, risk, and compliance program. Focus on SOC 2 Type II, HIPAA, and likely ISO 27001, building integrations, policy-as-code, evidence gathering, and audit workflows. Remote, full-time, with hands-on development of compliance tooling.

Responsibilities

  • Own SOC 2 Type II and HIPAA end to end: scoping, control design, evidence, auditor walkthroughs, and remediation
  • Scope and lead our next framework (ISO 27001 is the likely candidate) based on what customers actually ask for
  • Build and maintain the integrations that feed our GRC platform from our cloud providers, SaaS tools, and internal systems
  • Turn controls into continuous checks: policy-as-code, config drift detection, and a control-failure pipeline from detection to closure
  • Run the vendor security review program, from intake to periodic re-review
  • Own the security questionnaire and trust center workflow
  • Maintain the risk register and run risk assessments that produce documented decisions
  • Embed compliance requirements into the SDLC and change management so they're enforced by tooling, not by reminders
  • Reduce the number of things a human has to do to pass an audit every quarter

Qualifications

  • 5+ years in security, with demonstrated experience building automation for a GRC or compliance program
  • You've been the technical owner of at least one SOC 2 Type II or ISO 27001 audit and can tell us what you would do differently
  • You write code, and you use LLMs to get more done without lowering the bar
  • Hands-on with a GRC platform's API, not just its dashboard
  • Cloud IAM and configuration depth on at least one provider, GCP preferred
  • You can decide what evidence is sufficient and defend an automated test to an auditor
  • Comfortable being one of a few security engineers; you can scope, prioritize, and ship without a lot of process around you
  • Clear writer: policies, control narratives, and questionnaire answers are read by customers, so they have to be good

Skills

Required:SOC 2 Type IIPolicy as codeGRC platform APICloud IAM
Nice to have:ISO 27001

Benefits

  • Competitive Salary
  • Equity Ownership
  • Health Coverage
  • Work Gear
  • Flexible Vacation Policy
  • Diverse and Inclusive Team
Last updated Sep 30, 2026. Interested? Apply on the company site.
Clerk logo

About Clerk

More than authentication, Complete User Management

The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.

Next.jsReactRemixauthenticationbrex-fastest-growing-2025user managementweb
Company profileWebsite

More open roles at Clerk