GRC Engineer
Reflection13 hours ago
San Francisco, CA, USA or New York, NY, USAMid Level / Senior
Responsibilities
- Design and build automated controls and monitoring for access reviews, data minimization, model and data lineage, and continuous evidence collection.
- Partner with Engineering, Security, and IT to implement technical requirements from security frameworks, export controls, and privacy regulations.
- Build and maintain compliance workflow tooling, including intake forms, screening checks, reporting dashboards, and GRC platform integrations.
- Translate regulatory, policy, and contractual requirements into concrete technical specifications.
- Support customer security questionnaires, audits, vendor assessments, and technical due diligence.
- Maintain integrations between compliance systems and identity, data infrastructure, and model pipeline source-of-truth systems.
- Support technical environment separations and system boundaries required for regulatory compliance.
Requirements
- 3–6 years of software engineering, security engineering, or DevOps/infrastructure experience.
- Hands-on engineering experience supporting at least one of SOC 2, ISO 27001, or NIST frameworks.
- Ability to write production-quality code in Python or a similar language and work with APIs and integrations.
- Experience translating policy, regulatory, and contractual requirements into technical implementations.
- Familiarity with cloud infrastructure and identity and access management concepts.
- Experience building or maintaining GRC tooling, third-party risk management platforms, vendor risk platforms, or compliance automation such as Vanta.
- Familiarity with CMMC, NIST 800-171, NIST 800-53, SOC 2, ISO 27001, or GDPR/CCPA technical requirements.
- Experience with data governance or data lineage tooling, particularly in ML/AI pipelines.
- Background supporting a government contracting or regulated environment.
- Strong collaboration skills across compliance, legal, engineering, and other stakeholders.
Benefits
- Top-tier compensation and equity, including stock options; compensation figures are not stated.
- Comprehensive medical, dental, vision, and life insurance with an annual wellness allowance.
- Lunch and dinner provided daily in the office.
- 22 weeks of paid parental leave for birthing, non-birthing, adoptive, and surrogate parents.
- Unlimited paid time off in the U.S. and 30 vacation days in the U.K.
- Visa sponsorship and support for long-term immigration pathways where applicable.
- Regular off-sites, happy hours, and team celebrations.
- Employment may be conditioned on export-control authorization for access to certain technology or source code.
About Reflection
Reflection is a New York–based, privately held research lab developing open foundational AI models and agentic coding tools for developers, enterprises, and public-sector users. The team includes former researchers from DeepMind, OpenAI, and Anthropic, and their work focuses on transparent, customizable systems that organizations can deploy with ownership and control.