{"id":14532,"url":"https://alion.io/job/plaid-security-engineer-grc","title":"Security Engineer, GRC","company":{"id":4515,"name":"Plaid","domain":"plaid.com","url":"https://alion.io/company/plaid","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":95,"open_postings":5,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":72,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States","New York, United States","Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":156000,"max":213600,"currency":"USD","period":"year","gross":null,"usd_annual":213600},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"FedRAMP","optional":false},{"name":"GitHub","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"OpenAI","optional":false},{"name":"Python","optional":false},{"name":"Self-Healing","optional":false},{"name":"SOC 2","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-07-16T01:00:26Z","employer_posted_date":"2026-07-16","last_verified_at":"2026-10-19T22:33:15Z","board_verified":true,"closed_at":null,"days_open":95,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":95},"description":"We believe that the way people interact with their finances will drastically improve in the next few years. We’re dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products. Plaid powers the tools millions of people rely on to live a healthier financial life. We work with thousands of companies like Venmo, SoFi, several of the Fortune 500, and many of the largest banks to make it easy for people to connect their financial accounts to the apps and services they want to use. Plaid’s network covers 12,000 financial institutions across the US, Canada, UK and Europe. Founded in 2013, the company is headquartered in San Francisco with offices in New York, Seattle, Washington D.C., Raleigh, London, and Amsterdam.\nThe Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls. Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners. We own Plaid’s security compliance frameworks, run our audits and risk programs, and partner across the company to keep Plaid’s platform secure, resilient, and aligned with industry and regulatory expectations. GRC Engineering is how we make all of that scale - turning compliance into code, evidence into telemetry, and audits into a continuous, automated capability.\nThe Role:\nYou will own GRC Engineering at Plaid - a foundational, high-ownership role defining an emerging discipline from the ground up. Today most of our compliance work is manual and point-in-time; you will turn it into an engineered system that is continuous, data-driven, and scalable, and set the technical direction for the field.\n\nYou will:\nDefine the discipline and the architecture - how GRC Engineering works at Plaid, not just execute within it.\n\nBuild the foundation the function runs on - a codified source of truth for controls, policies, and evidence, fed by live pipelines and continuous controls monitoring.\n\nBe the engineering backbone for Security Assurance & Trust Enablement, Third-Party Ecosystem Risk, and Risk Management\n\nMake risk visible and data-driven - turning control and risk data into real-time signals for the team and leadership.\n\nPioneer where compliance is heading - compliance-agents-as-code in the SDLC, AI- and agent-driven workflows, and machine-readable continuous compliance (FedRAMP 20x).\n\nThis role is perfect for you if:\nYou think in systems: you'd rather design the thing that eliminates a whole class of manual work than automate one task at a time.\n\nYou love building and shipping internal tools and solutions that people actually use.\n\nYou're relentlessly curious - you poke, you investigate, and you dig into how controls can silently fail, drift, or get bypassed so you can catch it automatically.\n\nYou treat every roadblock as just an obstacle to route around - you don't back down, because there's always a path.\n\nYou like range - juggling several problems across security, risk, compliance, and engineering beats grinding on a single one.\n\nYou're energized by turning compliance from a documentation exercise into demonstrable, continuous, machine-readable evidence.\n\nResponsibilities:\nArchitect GRC's Engineering Foundation: Build the pipelines and codified source of truth the function runs on - controls, policies, and framework mappings captured as structured, version-controlled data and fed by live control and system state - so one control maps evidence across SOC 2, ISO, NIST, and beyond instead of being re-collected for every audit.\n\nBuild Continuous Controls Monitoring: Automate evidence collection, control testing, and monitoring across cloud and internal systems, and write and tune the detection that flags drift and misconfiguration against baseline - so audit readiness is continuous and gaps surface the moment they appear, not at audit time.\n\nTurn Data into Risk Signal: Build dashboards and SQL-driven reporting that turn raw control and risk data into KPIs, giving the team and leadership real-time visibility into risk posture.\n\nDrive Data-Informed Risk Assessments: Conduct security and technology risk assessments and recommend mitigations using data - keeping the risk management program running while cutting its manual overhead.\n\nAutomate Operational Toil: Eliminate the recurring manual work the team carries - evidence pulls, access and vendor reviews, questionnaires, risk-register upkeep, status reporting - with durable automation that gives time back across every workstream.\n\nShift Compliance Left with Code and AI: Embed compliance checks into the CI/CD flow as policy-as-code so controls are validated as code ships, prototype self-healing policies reconciled against live infrastructure, and scale agentic / AI-assisted workflows across the function.\n\nFuture-proof for Continuous Compliance: Build toward machine-readable, continuously validated evidence (FedRAMP 20x-style Key Security Indicators), positioning Plaid to meet continuous-compliance expectations as we enter new markets and pursue new authorizations.\n\nQualifications:\nSoftware & Data Engineering Foundations:\nStrong Python and SQL, with a proven track record of building API/webhook integrations that connect disparate systems.\n\nExperience owning an internal tool or service end to end - design, build, operate, and maintain - with real users depending on it.\n\nHands-on experience with AWS and cloud-native security controls, including the ability to query cloud, GitHub, and SaaS logs.\n\nProficiency with dashboarding / data-visualization tools (e.g., Mode) to turn control and risk data into KPIs and signal.\n\nApplied GRC Engineering:\nExperience building and operating continuous controls monitoring end to end - collecting signal from live systems, writing and tuning the detection logic that compares state to a baseline, alerting, and driving remediation.\n\nDemonstrated ability to model controls, policies, and framework mappings as structured, version-controlled data rather than docs and spreadsheets.\n\nHands-on experience with IaC (Terraform) and policy-as-code (OPA/Rego, Sentinel), including embedding compliance checks into CI/CD.\n\nProven ability to eliminate recurring operational toil - evidence pulls, access and vendor reviews, questionnaires, risk-register upkeep, status reports - with durable automation rather than one-off scripts.\n\nCompliance & risk knowledge:\nWorking knowledge of SOC 2, ISO 27001/27701, and NIST CSF/800-53, with the ability to map controls to evidence and crosswalk a single control across frameworks.\n\nExperience conducting security or technology risk assessments and translating findings into data-driven mitigation.\n\nFamiliarity with the shift to continuous compliance (FedRAMP 20x, machine-readable Key Security Indicators) and how it changes evidence and control design.\n\nAI fluency & tooling:\nDemonstrated ability to build and scale agentic / AI-assisted workflows (Claude, OpenAI) as leverage for the whole team.\n\nCross-functional effectiveness:\nAbility to work independently and cross-functionally across security, infrastructure, and engineering, with strong prioritization and the ability to influence without authority.\n\nNice to have:\nDirect experience with FedRAMP or FedRAMP 20x, or other public-sector / continuous-compliance authorizations.\n\nExperience with audit ›/ compliance automation platforms (Anecdotes, Drata, Vanta, Paramify, or similar).\n\nExposure to security incident response and triage.\n\nExperience in a high-growth fintech or financial-services environment.\n\nDegree in Computer Science, Cybersecurity, or a related field.\n\nOur mission at Plaid is to unlock financial freedom for everyone. To support that mission, we seek to build a diverse team of driven individuals who care deeply about making the financial ecosystem more equitable. We recognize that strong qualifications can come from both prior work experiences and lived experiences. We encourage you to apply to a role even if your experience doesn't fully match the job description. We are always looking for team members that will bring something unique to Plaid!\nPlaid is proud to be an equal opportunity employer and values diversity at our company. We do not discriminate based on race, color, national origin, ethnicity, religion or religious belief, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender, gender identity, gender expression, transgender status, sexual stereotypes, age, military or veteran status, disability, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state, and local laws. Plaid is committed to providing reasonable accommodations for candidates with disabilities in our recruiting process. If you need any assistance with your application or interviews due to a disability, please let us know at .\nPlease review our Candidate Privacy Notice here.\nAdditional compensation in the form(s) of equity and/or commission are dependent on the position offered. Plaid provides a comprehensive benefit plan, including medical, dental, vision, and 401(k). Pay is based on factors such as (but not limited to) scope and responsibilities of the position, candidate's work experience and skillset, and location. Pay and benefits are subject to change at any time, consistent with the terms of any applicable compensation or benefit plans.","description_format":"text","description_chars":9684,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance"],"lifecycle":[{"event":"open","at":"2026-07-16T01:00:26Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 32 · green card filings: 6","filings_12m":32,"filings_prev_12m":47,"green_card_filings_12m":6,"median_offered_wage_usd":184342,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":2}],"liveness":{"score":26,"band":"fade","label":"Fading","p_open":1,"p_active":0.48,"p_room":0.55,"age_days":95,"expected_fill_days":72,"reasons":["conf:2","velocity","win:tail","comp:brand"],"computed_at":"2026-10-19T05:45:15Z"},"pay":{"stated_usd_annual":213600,"is_top_pay":true},"html_url":"https://alion.io/job/plaid-security-engineer-grc","json_url":"https://alion.io/job/plaid-security-engineer-grc.json","meta":{"generated_at":"2026-10-19T22:53:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1853,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4515},"rest":"https://alion.io/mcp/rest/get_company?id=4515"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fplaid-security-engineer-grc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fplaid-security-engineer-grc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fplaid-security-engineer-grc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/plaid-security-engineer-grc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fplaid-security-engineer-grc"}]}