Senior Risk & Governance Engineer

The role

You will design and build technical automation for compliance testing, evidence collection, and risk monitoring. You will also own the governance architecture for how AI and agentic systems are built and deployed.

What you will do

• Design, build, and maintain automated compliance testing pipelines.
• Own the technical configuration and integration of the GRC platform.
• Develop and deploy AI-assisted workflows for evidence summarization and risk analysis.
• Own the governance framework for AI and agentic systems.
• Build the policy program as code using version control.
• Design a common controls framework for SOC 2, ISO 27001, ISO 42001, and future frameworks.
• Instrument controls with observability tooling for real-time signals.
• Build and maintain integrations between GRC tooling and the security stack.
• Collaborate with compliance teams and auditors to engineer automated pipelines.

Required qualifications

• 6+ years of experience in GRC, information security, risk management, or IT audit, preferably in a SaaS or cloud-native environment
• Strong understanding of security and compliance frameworks including SOC 2, ISO 27001, NIST CSF 2.0, and CIS Controls
• Working knowledge of ISO 42001 and NIST AI RMF
• AI-native mindset using LLMs, agents, and automation for substantive work
• Proficiency with GRC platforms for evidence management and control testing (Drata, Vanta, AuditBoard, ServiceNow GRC, or equivalent)
• Familiarity with cloud environments (AWS, Azure, or GCP) and security/compliance posture tooling
• Experience supporting external audits across security or privacy domains
• Hands-on experience implementing automated control collection and continuous control monitoring
• Working knowledge of risk registers, control libraries, and policy governance lifecycles
• Strong written communication, analytical thinking, and attention to detail
• 6+ years of experience in security engineering, DevSecOps, GRC tooling, or compliance automation
• Coding ability in Python or equivalent to build integrations and deploy pipelines

Nice to have

• Relevant certifications: CISA, CRISC, CISM, CISSP, CCSK, or ISO 27001 Lead Auditor/Implementer
• Experience with AI governance frameworks including ISO 42001, NIST AI RMF, EU AI Act, or OECD AI Principles
• Exposure to SOX ITGC cycles
• Privacy program crossover: data mapping, DPIAs, GDPR/CCPA operational compliance
• Scripting or automation experience (Python, JavaScript, or low-code tools) applied to GRC
• Experience with SOAR platforms or agentic AI orchestration frameworks (LangChain, n8n, Tines, AutoGen, or similar)
• Familiarity with policy-as-code and infrastructure-as-code approaches (Terraform, OPA/Rego)
• Experience shipping LLM or agent-powered tooling
• Background in detection engineering, security operations, or offensive security
• Experience building governance frameworks specifically for AI or agentic systems

About the company

AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations. The platform combines domain-specific AI with a vast content universe of over 500 million premium business documents.