Commercial GRC Engineer - Sr. Security Engineer I

The role

You will automate control monitoring and build evidence pipelines for commercial compliance frameworks. You will work with GRC platforms, cloud, and identity tooling to translate compliance requirements into technical control logic.

What you will do

• Own control automation for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks
• Express controls, control tests, and cross-framework mappings as version-controlled code
• Translate compliance requirements into technical control logic, workflows, and integrations
• Participate in architecture and design reviews to shift compliance left
• Design the engineer-facing experience of compliance including self-service status and guardrails
• Evaluate whether controls reduce relevant risk and propose alternative controls
• Support full audit cycles end-to-end including evidence requests and remediation tracking
• Build and maintain dashboards and reporting for real-time visibility into control health
• Identify and eliminate duplicate evidence-gathering effort across frameworks
• Diagnose root causes of recurring control failures and fix underlying gaps

Required qualifications

• 4+ years of experience in GRC engineering, security engineering, compliance automation, or IT audit support
• Hands-on ownership of at least one full certification cycle (SOC 2, ISO 27001, or similar)
• Practical, hands-on experience with GRC or compliance automation platforms (Vanta, Drata, Secureframe, or a homegrown equivalent)
• Experience with cloud security fundamentals (AWS/GCP/Azure IAM, logging, encryption)
• Solid working knowledge of SOC 2, ISO 27001, and HIPAA control requirements
• Comfort with scripting or light development (Python, JavaScript, or similar)
• Strong written communication
• Ability to trace a control failure or audit finding back to its root cause

Nice to have

• ISO 27017/27701

Benefits

• Employer subsidized medical/vision and dental coverage
• 401k Match (50% of your contribution up to the first 6% of your eligible pay)
• Monthly stipend to support your work and productivity
• Flexible Time Away Program
• Sick Time Off
• Smartsheet-sponsored life, short-term, and long-term disability plans
• 12 paid holidays per year
• Up to 24 weeks of Parental Leave
• Personal paid Volunteer Day
• Access to Udemy online courses
• Company Funded Perks including counseling membership, local retail discounts, and a personal Smartsheet account
• Teleworking options

Before you apply

• Legally eligible to work in the U.S. on an ongoing basis

About the company

Smartsheet empowers teams to manage work seamlessly and scale solutions smarter by uniting human teams with AI agents. The company creates space for people to focus on judgment, creativity, and big thinking.