{"id":580251,"url":"https://alion.io/job/a-lign-senior-grc-engineer","title":"Senior GRC Engineer","company":{"id":6431,"name":"A-LIGN","domain":"a-lign.com","url":"https://alion.io/company/a-lign","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Panama"],"countries":["PA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":44000,"max_usd":98000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":8444},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"FedRAMP","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"Google GKE","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"NIST 800-171","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"CI/CD","optional":true},{"name":"Kubernetes","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"STRIDE","optional":true}],"status":"live","first_seen_at":"2026-09-08T15:47:35Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-10-31T19:28:13Z","board_verified":true,"closed_at":null,"days_open":53,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":53},"description":"About the Role \nThe Senior GRC Engineer owns audit evidence collection and technical control maintenance across A-LIGN's growing portfolio of compliance frameworks, including FedRAMP Moderate Equivalency, FedRAMP 20x, ISO 27001, ISO 42001, and SOC 2. This role bridges the GRC function and A-LIGN's technical teams, working hands-on in GCP, GitHub, and Microsoft 365 to collect evidence, verify controls, and keep A-LIGN continuously audit-ready. The Senior GRC Engineer works cross-functionally with every technical department in the company to reduce audit burden on engineering and IT while protecting the certifications that A-LIGN's clients and platforms depend on. The role also supports broader information security activities, including risk assessments, threat modeling, security reviews, and AI technical safeguards.\nReports to\nChief Information Security Officer\nPay Classification\nFull-Time \nResponsibilities \nOwn end-to-end audit evidence collection, validation, and organization across A-LIGN's compliance frameworks, including FedRAMP (Moderate Equivalency and FedRAMP 20x), ISO 27001, ISO 42001, SOC 2, NIST 800-53, and NIST 800-171\nMaintain and continuously verify technical controls across A-LIGN's cloud and corporate environments, including Google Cloud Platform (GCP/GKE), GitHub, and Microsoft 365/Entra ID\nServe as the primary liaison between the GRC function and technical departments (IT, Engineering, DevOps) to gather evidence, validate control implementation, and reduce audit burden on those teams\nSupport FedRAMP continuous monitoring activities, including Key Security Indicator (KSI) evidence, vulnerability scan artifact collection, POA&M tracking, and assessor (3PAO) requests\nBuild and maintain evidence automation, including integrations between GRC tooling and source systems (identity provider, cloud platforms, code repositories, ticketing, endpoint management) to reduce manual collection effort\nSupport A-LIGN's ISO 42001 Artificial Intelligence Management System (AIMS), including AI risk register evidence, AI control monitoring, and nonconformity remediation tracking\nPrepare audit-ready evidence packages and coordinate directly with external assessors and certification bodies during assessment windows\nMonitor control health between audit cycles, identify control drift or failures, and drive remediation with control owners before findings occur\nMaintain compliance documentation, including control narratives, policies, and procedures\nSupport supplier and vendor security reviews with framework-specific evidence requirements\nTrack framework changes (FedRAMP 20x requirements, ISO standard revisions, SOC 2 criteria updates) and translate them into actionable control and evidence updates\nConduct security risk assessments and contribute to A-LIGN's corporate risk management program and risk register\nParticipate in threat modeling for A-SCEND features, internal systems, and AI use cases, and translate findings into control improvements\nPerform security reviews of new tools, vendors, and internal initiatives, including support for Vendor Review Board activities\nImplement and validate AI technical controls and safeguards, including data loss prevention, AI connector and agent governance, and acceptable use enforcement, in support of A-LIGN's AI Management System\nReport compliance posture, evidence status, and audit readiness metrics to the CISO and GRC leadership\nMinimum Qualifications \nEDUCATION \nBachelor's degree in information systems, cybersecurity, business, or equivalent combination of education and experience\nEXPERIENCE \n5+ years of experience in information security, GRC, IT audit, or compliance engineering roles\nHands-on experience with audit evidence collection and technical control validation for at least one of the following required: FedRAMP, GovRAMP, NIST 800-53, or NIST 800-171\nAdditional experience with ISO 27001, ISO 42001, or SOC 2 preferred but not required\nDevSecOps or cloud engineering experience sufficient to independently locate and extract evidence from GCP, GitHub, and Microsoft 365/Entra ID environments\nExperience with GRC platforms and evidence automation (AuditBoard, Vanta, Drata, or similar)\nExperience supporting external audits and assessor interactions, including 3PAO assessments\nWorking knowledge of vulnerability management, CI/CD pipelines, infrastructure-as-code, and identity and access management concepts\nExperience scripting or automating evidence collection (Python, PowerShell, or similar) preferred\nFamiliarity with risk assessment methodologies, threat modeling (e.g., STRIDE), and security review processes preferred\nCERTIFICATIONS \nCISA, CISSP, CCSK/CCSP, ISO Lead Auditor/Implementer, or relevant certifications preferred but not required\nSKILLS \nStrong cross-functional collaboration and project management skills\nAbility to translate framework requirements into clear, actionable requests for technical teams\nHighly organized with the ability to manage evidence deadlines across multiple concurrent audit cycles\nExcellent written communication for control narratives, evidence descriptions, and assessor responses\nSelf-directed with strong follow-through in a fast-paced, deadline-driven environment\nProven experience utilizing AI tools to automate manual tasks, streamline workflows, and increase team efficiency\nExperience operating in PE-backed or high-growth environments preferred\nBenefits \nEmployer Paid Life & Health Insurance \nCompetitive Bonus Structure \nHome Office Reimbursement \nTechnology Allowance \nCertification Reimbursement \nBeneficiaT Discount Loyalty Program \nPersonalized Career Coaching \nGenerous Paid Time Off \nPaid Office Closure December 25-January 1 \nSummer Hours \nAbout A-LIGN \nA-LIGN is the leading provider of high-quality, efficient cybersecurity compliance programs. Combining experienced auditors and audit management technology, A-LIGN provides the widest breadth and depth of services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. A-LIGN is the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor. To learn more, visit a-lign.com. \nCome Work for A-LIGN! \nApply online today at A-LIGN.com and learn about life at A-LIGN by following us on LinkedIn. \nA-LIGN is an Equal Opportunity Employer.","description_format":"text","description_chars":6274,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":["Certification reimbursement","Health insurance","Home office"],"hiring_locations":[{"name":"Panama","iso":"PA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Compliance","Testing, Inspection & Certification"],"lifecycle":[{"event":"open","at":"2026-09-09T21:21:48Z"}],"visa":[],"liveness":{"score":47,"band":"ok","label":"Likely open","p_open":1,"p_active":0.848,"p_room":0.55,"age_days":52,"expected_fill_days":46,"reasons":["conf:1","velocity","win:tail"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/a-lign-senior-grc-engineer","json_url":"https://alion.io/job/a-lign-senior-grc-engineer.json","meta":{"generated_at":"2026-10-31T22:56:08Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35747,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6431},"rest":"https://alion.io/mcp/rest/get_company?id=6431"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fa-lign-senior-grc-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fa-lign-senior-grc-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fa-lign-senior-grc-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/a-lign-senior-grc-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fa-lign-senior-grc-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":580251}},{"tool":"search_jobs","arguments":{"company":"a-lign.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":580251},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}