GRC Engineer

About the role

Reflection AI is building open AI models and needs a Governance, Risk & Compliance (GRC) Engineer to turn compliance policies into scalable technical controls. You will work at the intersection of compliance and engineering, automating evidence collection and building tooling that supports security frameworks and data governance.

Key responsibilities

• Design and implement automated controls and monitoring to satisfy SOC 2, ISO 27001, NIST 800-53/800-171, and CMMC requirements.
• Partner with engineering, security, and IT teams to integrate technical requirements from security frameworks, export controls, and privacy regulations.
• Build and maintain internal tooling for compliance workflows, including intake forms, screening checks, reporting dashboards, and GRC platform integrations such as Vanta.
• Translate regulatory and policy requirements into concrete technical specifications for engineering teams.
• Support technical due diligence for customer security questionnaires, audits, and vendor assessments.

Required profile

• 3‑6 years of software, security, or DevOps/infrastructure engineering experience.
• Hands‑on experience implementing at least one security framework (SOC 2, ISO 27001, or NIST) as an engineer.
• Strong collaboration skills with compliance, legal, and engineering stakeholders.
• Experience supporting regulated or government‑contracting environments.

Required skills

• Production‑quality programming in Python (or similar).
• API development and integration experience.
• Familiarity with cloud infrastructure and identity/access management concepts.
• Experience with GRC tooling or compliance automation platforms (e.g., Vanta).

What we offer

• Top‑tier compensation with salary and equity.
• Stock options for all contributors.
• Comprehensive health, dental, vision, and life coverage plus an annual wellness allowance.
• Daily lunch and dinner provided on‑site.
• 22 weeks paid parental leave for all new parents.
• Unlimited PTO in the U.S. (30 days in the U.K.).
• Visa sponsorship and immigration support.
• Regular team‑building off‑sites and events.