← All roles

GRC Engineer

Reflection· Legal
Apply on company site
New York, NY, San Francisco, CAFull-timePosted 1w ago

About the role

Reflection AI seeks a Governance, Risk, & Compliance (GRC) Engineer to translate regulatory and policy requirements into scalable technical controls. The role bridges compliance and engineering, focusing on automated evidence, security framework alignment (SOC 2, ISO 27001, NIST), and programs across Trade Compliance, Privacy, Data Governance, and TPRM.

Responsibilities

  • Design and build automated controls and monitoring that satisfy security framework requirements (SOC 2, ISO 27001, NIST 800-53/800-171, CMMC): access reviews, data minimization, model/data lineage, continuous evidence collection
  • Partner with Engineering, Security, and IT to implement technical requirements arising from security frameworks, deemed export controls, and privacy regulations
  • Build and maintain internal tooling that supports compliance workflows (intake forms, screening checks, reporting dashboards, GRC platform integrations such as Vanta)
  • Translate regulatory and policy requirements into concrete technical specifications engineering teams can implement
  • Support technical due diligence for inbound customer security questionnaires, audits, and outbound vendor assessments
  • Maintain integrations between compliance/GRC systems and source-of-truth systems (identity, data infrastructure, model pipelines)
  • Help scope and support technical environment separations or system boundaries required for regulatory compliance (e.g., subsidiary or enclave environments)

Qualifications

  • 3-6 years of software engineering, security engineering, or DevOps/infrastructure experience
  • Hands-on experience supporting at least one security framework (SOC 2, ISO 27001, or NIST) as an engineer
  • Comfortable writing production-quality code (Python, or similar) and working with APIs/integrations
  • Experience translating non-technical requirements (policy, regulatory, contractual) into technical implementation
  • Familiarity with cloud infrastructure and identity/access management concepts
  • Strong collaboration skills; able to work effectively with compliance, legal, and engineering stakeholders
  • Experience building or maintaining GRC tooling, TPRM/vendor risk platforms, or compliance automation (e.g., Vanta or similar)
  • Familiarity with one or more relevant frameworks: CMMC, NIST 800-171/800-53, SOC 2, ISO 27001, GDPR/CCPA technical requirements
  • Experience with data governance or data lineage tooling, especially in ML/AI pipelines
  • Background supporting a government contracting or regulated environment

Skills

Required:Automated controls and monitoringRegulatory translationPython / production-ready codingCloud & IAMCross-functional collaboration
Nice to have:GRC tooling (e.g., Vanta)

Benefits

  • Top-tier compensation: Salary and equity structured to recognize and retain our talent globally.
  • Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options.
  • Health & wellness: Comprehensive medical, dental, vision, and life, with an annual wellness allowance.
  • Meals: Lunch and dinner are provided in the office daily.
  • Life & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.
  • Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K.
  • Sponsorship support: We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable.
  • Team building: Regular off-sites, happy hours, and team celebrations.
Last updated Oct 22, 2026. Interested? Apply on the company site.

About Reflection

Building frontier open intelligence

Building frontier open intelligence.

liquid-ai-recruiting-target
Company profileWebsite

More open roles at Reflection