Senior GRC Engineer

The role

You will lead the engineering behind governance, risk and compliance (GRC) systems. You will turn security requirements into production controls, evidence pipelines and tests.

What you will do

• Build production systems that collect, validate and preserve technical control evidence.
• Automate shared security controls when a central implementation is the right solution.
• Write tests that show whether controls operate as designed and continue to work over time.
• Connect requirements, controls, implementations, tests, evidence, policies and procedures.
• Detect missing, stale or incomplete evidence.
• Build workflows that identify drift between approved policies and technical implementations.
• Prepare reproducible evidence packages for the Compliance team.
• Join audits as a technical subject matter expert.
• Answer internal questions for go-to-market teams about our compliance and security posture.
• Help the Compliance and Legal teams assess how new requirements affect our security controls and systems.

Required qualifications

• Senior engineer who is comfortable owning a defined problem from design through production.
• Can build and operate production software, automation or data pipelines.
• Can work with application programming interfaces, cloud services and structured data from several systems.
• Can translate security or compliance requirements into technical controls and testable conditions.
• Can design evidence records with clear provenance, scope, collection time and retention requirements.
• Can build monitoring that detects failed collection, stale evidence and control failure.
• Can apply software engineering practices to compliance work, including testing, version control and code review.
• Can explain technical controls and evidence to engineers, compliance colleagues and auditors.
• Can make sound engineering decisions when the implementation path is not prescribed.
• Can balance automation with access control, data minimisation and operational safety.

Nice to have

• Experience with ISO 27001, C5, SOC 2 and other security or quality management assessments.
• Experience with controls as code, policy as code or continuous control monitoring.
• Experience in healthcare, another regulated environment or a high-growth technology company.
• Experience with infrastructure as code, cloud security, identity systems or continuous integration and delivery pipelines.
• Experience integrating compliance platforms or integrated management systems with technical data sources.
• Experience building evidence systems with access, retention and auditability requirements.
• Experience using AI to support control mapping, evidence review or policy analysis with human approval and traceable outputs.

Benefits

• Competitive salary and company stock options.
• 30 days of paid holiday each year.
• 5,000 SEK wellness allowance, plus 6,000 SEK each year for other health-related initiatives.
• Parental leave top-up for new parents.
• Private medical insurance.
• Mental health support through Mindler.
• Pension programme.
• Regular social and team activities, including off-sites and seasonal events.

Before you apply

• Apply with your CV in English.
• Tandem will conduct a background check before hiring.

About the company

Tandem Health is a fast-scaling health-tech company that reimagines healthcare by putting clinicians first. Their platform is designed by clinicians, for clinicians, with intuitive medical notes and workflows.