GRC Engineer

The role

You will grow the governance, risk, and compliance function by translating regulatory requirements into automated controls and policies. You will manage compliance programs like SOC 2 and CMMC and support customers through security due diligence.

What you will do

• Design, build, and maintain automated systems for continuous controls monitoring across cloud infrastructure, CI/CD, and SaaS stack.
• Own and mature compliance programs including SOC 2 Type II, CMMC, and future frameworks.
• Provide subject matter expertise in risk assessment, controls design, security policy, vendor risk, access review automation, and audit management.
• Assess technical and organizational risk and implement scalable solutions.
• Execute GRC duties from writing policy to shipping automation.
• Collaborate with Security and Engineering to implement solutions.
• Ensure successful rollout of risk registers, access reviews, vendor risk assessments, and audit cycles.
• Lead and contribute to projects as a member of the Security team.
• Support customers and prospects through security questionnaires and due diligence requests.

Required qualifications

• 3+ years in GRC engineering, security engineering, or compliance with hands-on technical work
• Expertise across compliance frameworks (SOC 2, CMMC, FedRAMP, NIST CSF, GDPR)
• Track record of designing and implementing risk or compliance programs
• Strong prioritization and project management skills
• Experience partnering with and influencing engineering and security leaders
• Clear communication style
• Ability to see all sides of a risk tradeoff and drive issues to resolution
• BA / BS in a related field or equivalent practical experience

Nice to have

• Startup experience
• Relevant security or audit certifications (CISSP, CISA, CRISC, or similar)
• Proficiency in at least one scripting or programming language (Python, Go, TypeScript)
• Experience standing up a GRC program or compliance automation tooling (Vanta, Drata, Secureframe, OneTrust)
• Working knowledge of cloud platforms (AWS, GCP, Azure) and their native security and logging tooling

Benefits

• 401(k) match
• 100% coverage of medical, dental, and vision premiums for you and your dependents
• 12 weeks paid parental leave
• Family-forming stipends
• Gender-affirming care stipends
• Unlimited PTO

About the company

Cape is America’s privacy-first mobile carrier. They built their own network from scratch to provide secure mobile services to consumers, businesses, and government agencies.