GRC Engineer

Key Responsibilities

• Operate the ISO 27001:2022 ISMS, including internal audits and management reviews.
• Run SOC 2 scoping, control mapping, and auditor walkthroughs.
• Maintain a control framework mapped across ISO 27001, SOC 2, SOX IT NIST CSF 2.0, and NIST SP 800-53 Rev. 5.
• Administer Drata, including control library management and integrations with various systems.
• Stand up the cyber risk program, defining methodologies and building the initial risk register.
• Manage the vendor lifecycle in Drata, including assessments and ongoing monitoring.
• Draft and manage the policy lifecycle, ensuring compliance and risk metrics are reported to leadership.

Key Requirements and Technology Experience

• Certifications: ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, CISM, CISSP, or CCSP.
• Experience in energy, critical infrastructure, or data center environments.
• Familiarity with OT/ICS frameworks (IEC 62443, NIST SP 800-82) or NERC CIP.
• Exposure to SEC cybersecurity disclosure rules and board-level reporting.
• 6+ years in security GRC, compliance engineering, or IT audit, including 2 years of hands-on technical work (automation, integrations, scripting).
• Experience operating ISO 27001:2022 through a certification or surveillance audit, and SOC 2 audit experience with Type II evidence.
• Practical knowledge of SOX ITGCs and evidence expectations at a publicly traded company.
• Hands-on administration of Drata or a comparable platform (Vanta, Secureframe, etc.).
• Scripting experience in Python, PowerShell, or similar, with comfort in REST APIs for evidence collection.
• Strong written communication skills for diverse audiences, including engineers and executives.