← All roles

GRC Engineer

Cape· Security
Apply on company site
Hybrid (Hybrid, DC), Hybrid (Hybrid: Arlington, VA)$155k - $185kFull-timePosted 1w ago

About the role

GRC Engineer responsible for growing Cape's governance, risk, and compliance function, translating regulatory requirements into automated controls, policies, and engineering solutions, and supporting audits, due diligence, and customer security inquiries.

Responsibilities

  • Design, build, and maintain automated systems for continuous controls monitoring across cloud infrastructure (AWS/GCP/Azure), CI/CD, and SaaS stack.
  • Own and mature our compliance programs end-to-end (SOC 2 Type II, CMMC, and future frameworks), including audit prep, evidence collection, and remediation tracking.
  • Provide subject matter expertise in: risk assessment, controls design, security policy, vendor/third-party risk, access review automation, and audit management.
  • Proactively assess technical and organizational risk, make data-driven recommendations, and implement scalable solutions rather than one-off manual fixes.
  • Roll up your sleeves to execute a full range of GRC duties — from writing policy to shipping the automation that enforces it.
  • Collaborate closely with Security and Engineering to implement solutions across risk management, policy, and compliance tooling.
  • Ensure successful rollout of key GRC programs such as risk registers, access reviews, vendor risk assessments, and audit cycles.
  • Lead and contribute to projects as an integral member of the Security team.
  • Support customers and prospects through security questionnaires, due diligence requests, and trust-building conversations, and build tooling to make that process faster.

Qualifications

  • 3+ years in GRC engineering, security engineering, or compliance with hands-on technical work; startup experience preferred.
  • Demonstrable expertise across compliance frameworks (SOC 2, CMMC, FedRAMP, NIST CSF, GDPR), including how regulatory and contractual requirements translate into technical controls and day-to-day engineering decisions.
  • Successful track record of designing and implementing risk or compliance programs, with processes that are clear and auditable but adapt as the business and regulatory landscape change.
  • Strong prioritization and project management skills, especially when running audits against real deadlines.
  • Experience partnering with and influencing engineering and security leaders to drive risk decisions and audit outcomes; ability to build trust with engineers and auditors.
  • Clear communication style, ability to translate technical risk into business terms for different audiences.
  • Ability to see all sides of a risk tradeoff, remain objective, and drive issues to resolution — including through ambiguity, with a willingness to roll up your sleeves.
  • BA / BS in a related field or equivalent practical experience; relevant security or audit certifications (CISSP, CISA, CRISC, or similar) a plus.
  • (Bonus) Proficiency in at least one scripting or programming language (Python, Go, TypeScript) to automate evidence collection, monitoring, and reporting.
  • (Bonus) Experience standing up a GRC program or compliance automation tooling (Vanta, Drata, Secureframe, OneTrust) from scratch, and working knowledge of cloud platforms (AWS, GCP, Azure) and their native security and logging tooling.

Skills

Required:GRC program designRegulatory frameworks
Nice to have:Automation / scripting

Benefits

  • 401(k) match
  • 100% coverage of medical, dental, and vision premiums for you and your dependents
  • 12 weeks paid parental leave (for all parents, no waiting period)
  • Stipends for family-forming needs
  • Stipends for gender-affirming care
  • Unlimited PTO
Last updated Oct 21, 2026. Interested? Apply on the company site.
Cape logo

About Cape

Cape is premium wireless coverage with an added layer of personal security.

Cape is premium wireless coverage with an added layer of personal security. Talk, text, and live with the confidence that you’re protected.

wireless coveragepersonal securityprivacy-firstmobile securityeSIMprivacy-oriented
Company profileWebsite

More open roles at Cape