{"id":2233741,"url":"https://alion.io/job/one-identity-senior-security-engineer-grc-engineering","title":"Senior Security Engineer GRC Engineering","company":{"id":9394,"name":"One Identity","domain":"oneidentity.com","url":"https://alion.io/company/one-identity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":18000,"max_usd":40000,"period":"year","method":"role_seniority_country_cell","sample_n":10},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"FedRAMP","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"Telegram","optional":false}],"status":"live","first_seen_at":"2026-10-10T23:25:25Z","employer_posted_date":"2026-10-10","last_verified_at":"2026-10-12T10:32:59Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Overview\nSenior Security EngineerGRC Engineering\nOne Identity · Information Security, Customer Trust & Assurance\nSenior individual contributor · India · Reports to the Director of Information Security\nWhy this role exists\nOne Identity holds certifications because customers require them before they buy, and the ones ahead open international regulatory markets. This role builds the centralized common controls framework, with ISO 27001 and SOC 2 as the base, that each addition maps into. Evidence comes from continuous monitoring, an audit request is answered with a query rather than an email thread, and the next market is a mapping exercise that unlocks revenue opportunities for the company.\nWe run hosted services in Azure and AWS and ship software customers deploy in their own datacenters, so the evidence sits in cloud control planes, build pipelines, identity systems, and endpoints. Compliance analysts run the assessments and own questionnaire response. This seat builds the systems they draw from: an answer to an auditor and an answer to a customer should come from the same facts.\nWe're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this seat owns the compliance engineering program. Scope comes from what you ship and from what the auditors accept.\nWhat you'll do\nMake evidence a query\nOwn continuous control monitoring end to end: integrations into the identity provider, cloud control planes, code repositories, endpoint management, and ticketing, with alerting and escalation wired in, so a control that degrades reaches its owner with the context to act and the monitoring confirms the fix.\nBuild the centralized common controls framework and the artifact layer on it: ISO 27001 and SOC 2 as the base, each new framework mapped against it, and evidence captured, timestamped, and indexed against the control that requires it. A control tested once answers every framework referencing it, and an audit-ready package assembles on demand.\nHold the platform to its own standard. The evidence system sits inside audit scope, logs its own activity, and operates within the controls it measures.\nPut controls in code\nWrite control validation as code: checks that programmatically test whether a control is implemented, with output an auditor accepts and an engineer can act on. Where a failed check traces to code, the correction arrives as a pull request against the pipeline, policy, or configuration that produced it. PRs, not tickets.\nPartner with the principal infrastructure seat on policy as code. They set the enforcement architecture inside the cloud platform; you make sure every enforced policy emits the evidence the frameworks require.\nDecide where agentic workflows belong in compliance engineering. Control mapping, evidence classification, and first-pass validation are tractable now; attestation is a human act. You set where automation acts, where it recommends, and how its output is verified. The same discipline applies to your own build: automation shares the lift, and nothing ships unverified.\nOwn the program\nOwn the program's direction. Which frameworks come next, which controls get automated first, and where the engineering effort goes: those calls are this seat's to make and to defend.\nAdvance the program's metrics: control health, coverage against the framework map, remediation velocity, and the trend lines leadership steers by, produced from the same data the auditors draw on.\nIntegrate cyber risk management into the platform: the risk register and exception handling run on the same control telemetry, automated wherever the workflow allows, with the hands-on remainder worked alongside the compliance analysts. An acceptance carries an owner and an expiry.\nOwn asset prioritization as the base layer of the program: which systems and data matter most, kept current through automation, feeding risk decisions, control coverage, and remediation order.\nFront the technical side of audits: walk an assessor through how a control is implemented and how its evidence was produced, in language that holds up under the follow-up question.\nWhat we're looking for\nRequired\nSix or more years across compliance program leadership and security or compliance engineering, with time spent on both the framework side and the build side. Equivalent depth counts.\nDepth in at least one of two forms: a major framework carried through assessment under your leadership, FedRAMP or comparable, from readiness through certification or authorization; or GRC engineering you owned end to end, with control telemetry, continuous monitoring, and evidence automation built and run under your direction.\nStrategic framework design: control mapping across frameworks you shaped yourself, and a defensible view on how a common controls framework should be structured.\nEngineering depth you've used recently: Python and API integration work of your own, and hands-on building with AI in the loop within the last six months. We'll ask what you built, when, and how you verified what the tooling produced.\nThe three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.\nAlso matters: f ramework fluency across ISO 27001 and SOC 2, and familiarity with FedRAMP 20x, where machine-validated Key Security Indicators are the assessment mechanism; NIS2, DORA, and PCI DSS and where they surface in customer requirements; policy-as-code frameworks and a view on where enforcement belongs; enough Azure and AWS depth to know where the evidence lives; a compliance automation platform and the judgment to know what to build around it; running an audit calendar and an assessor relationship without drama; writing an auditor and an engineer can both act on.\nHelpful: time on the assessor's side of the table; IRAP or another regime outside the US; evidence work across hosted services and customer-deployed software; prior time as a software or platform engineer.\nWhat you should know going in\nThis seat brings the engineering function to modernize GRC. You direct where the engineering effort goes, you shape the tooling it runs on, and you build it. The bar is strategic and technical at once: the insight to shape the program and the depth to build the system that runs it, using AI to take lift out of the work without handing it the judgment. If you'd rather build the system that answers the question than answer the question, this is that seat.\nCompany Description\nOne Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.\nWith team members around the globe, we intend to continue to grow revenues and add value to customers.\nWhen you join our team, you will have the opportunity to build and develop products at a scale few others can provide.\nOur product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.\nWorking with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.\nWhy work with us?\nLife at One Identity means collaborating with dedicated professionals with a passion for technology.\nWhen we see something that could be improved, we get to work inventing the solution.\nOur people demonstrate our winning culture through positive and meaningful relationships.\nWe invest in our people and offer a series of programs that enables them to pursue a career that fulfills their potential.\nOur team members’ health and wellness is our priority as well as rewarding them for their hard work.\nOne Identity is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind: One Identity is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment.\nAll employment decisions at One Identity are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate.\nOne Identity will not tolerate discrimination or harassment based on any of these characteristics. One Identity encourages applicants of all ages.\nCome join us.\nNote: We do not use text messaging or third-party messaging apps like Telegram to communicate with applicants, so please exercise caution if you are approached in this way and only interact with people claiming to be One Identity employees if they have an email address ending in @oneidentity.com.","description_format":"text","description_chars":9204,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-10T23:25:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":32,"reasons":["conf:2","win:early"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/one-identity-senior-security-engineer-grc-engineering","json_url":"https://alion.io/job/one-identity-senior-security-engineer-grc-engineering.json","meta":{"generated_at":"2026-10-12T14:06:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22159,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9394},"rest":"https://alion.io/mcp/rest/get_company?id=9394"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fone-identity-senior-security-engineer-grc-engineering"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fone-identity-senior-security-engineer-grc-engineering"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fone-identity-senior-security-engineer-grc-engineering"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/one-identity-senior-security-engineer-grc-engineering\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fone-identity-senior-security-engineer-grc-engineering"}]}