GRC Engineer

About the role

ButterflyMX is seeking a GRC Engineer to own and evolve its governance, risk, and compliance program, leveraging AI‑driven automation to replace manual processes and enable continuous compliance at scale.

Key responsibilities

• Own and continuously mature the company risk register, using AI tooling to surface and score emerging risks.
• Lead external audit management (SOC 2 Type II) and automate evidence collection pipelines in Vanta.
• Engineer the Trust and Assurance program with automated intake, AI‑assisted response generation and self‑service partner due‑diligence.
• Build a vendor and supply‑chain risk program with automated intake, tiered scoring and continuous monitoring triggers.
• Redesign and maintain security and privacy policies using AI‑driven drafting and lightweight review workflows.

Required profile

• 3+ years experience in GRC, information security compliance, or risk management.
• Hands‑on experience supporting or leading SOC 2 audits.
• Strong organizational skills to manage multiple concurrent workstreams.
• Excellent written communication for policy documents and executive risk summaries.

Required skills

• Experience with the Vanta platform or equivalent GRC tools.
• Familiarity with frameworks such as SOC 2, ISO 27001, NIST CSF, and related standards.
• Proven ability to leverage AI tools to automate compliance workflows.
• Experience conducting third‑party/vendor risk assessments.

What we offer

• Base salary $130,000‑$170,000 per year.
• Comprehensive medical, dental and vision plans (80% covered).
• 401(k) plan with company match.
• Paid time off: 10 holidays, 20 vacation days, 5 sick days, 3 floating holidays.
• Life, AD&D, short‑ and long‑term disability insurance fully covered.
• Quarterly self‑care stipends and flexible benefits options.