{"id":1430501,"url":"https://alion.io/job/smartsheet-commercial-grc-engineer-sr-security-engineer-i","title":"Commercial GRC Engineer - Sr. Security Engineer I","company":{"id":1678,"name":"Smartsheet","domain":"smartsheet.com","url":"https://alion.io/company/smartsheet","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":80,"open_postings":23,"ghost_share":0,"stale_share":0.783,"repost_share":0,"time_to_fill_p50_days":57,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Bellevue, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":145000,"max":193750,"currency":"USD","period":"year","gross":null,"usd_annual":193750},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"JavaScript","optional":false},{"name":"Jira","optional":false},{"name":"Python","optional":false},{"name":"Slack","optional":false},{"name":"Smartsheet","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-28T22:46:26Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-15T11:08:52Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day.\nSmartsheet maintains certifications and attestations across SOC 2 Type II, the ISO 27001/27017/27701/22301 suite, HIPAA, and other commercial compliance frameworks-and the manual work of proving those controls quarter after quarter doesn't scale with the business. We're looking for a Sr. Security Engineer I to bring an engineering mindset to our commercial GRC program: automating control monitoring, building evidence pipelines, and reducing the audit-season scramble into a default state of readiness. You'll work hands-on with our GRC platform, cloud, and identity tooling to make control evidence collect itself wherever possible, and you'll partner closely with engineering teams to translate compliance requirements into technical control logic they can actually build against. This is a builder's role within GRC-less checklist administration, more systems thinking applied to compliance. Our approach is grounded in GRC Engineering principles: automate early and often, treat controls and their mappings as code, favor continuous assurance over periodic checks, and build compliance that engineers can consume as easily as they contribute to it.\nThis role reports to the Senior Director, GRC Engineering and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer.\nYou Will:\nOwn control automation for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks: design and build automated evidence collection and continuous control monitoring across cloud, identity, endpoint, and SaaS systems.\nExpress controls, control tests, and cross-framework mappings as version-controlled code so they are reviewable, testable, and reusable rather than locked in a single tool's configuration.\nTranslate compliance requirements into technical control logic, workflows, and integrations, partnering with engineering, IT, and security teams to embed controls into existing systems and pipelines rather than bolting them on after the fact.\nShift compliance left by participating in architecture and design reviews, defining control requirements as acceptance criteria for new systems, and helping teams build compliant-by-default infrastructure.\nDesign the engineer-facing experience of compliance: self-service control status, guardrails and paved-road patterns, and compliance feedback delivered in the tools teams already use (CI/CD, Jira, Slack) rather than only in the GRC platform.\nEvaluate whether controls actually reduce relevant risk-not just whether they exist-and propose alternative controls when a framework default doesn't fit our threat model or workload architecture.\nSupport full audit cycles end-to-end: coordinate evidence requests, populate and maintain the evidence library, respond to auditor follow-ups, and track remediation items through closure for SOC 2, ISO, and HIPAA assessments.\nBuild and maintain dashboards and reporting that give GRC and security leadership real-time visibility into control health, evidence freshness, and audit readiness across frameworks.\nIdentify and eliminate duplicate evidence-gathering effort across overlapping frameworks by mapping controls once and reusing that mapping across SOC 2, ISO, and HIPAA.\nDiagnose the root causes of recurring control failures or stale evidence and fix the underlying process, tooling, or ownership gap rather than the symptom.\nPartner with the GRC Team Lead and SATellite engineering to extend our internal GRC platform's control, evidence, and risk-lifecycle capabilities.\nYou Have:\n4+ years of experience in GRC engineering, security engineering, compliance automation, or IT audit support, with hands-on ownership of at least one full certification cycle (SOC 2, ISO 27001, or similar).\nPractical, hands-on experience with GRC or compliance automation platforms (Vanta, Drata, Secureframe, or a homegrown equivalent), including configuring integrations and building evidence pipelines-not just reading dashboards.\nExperience with cloud security fundamentals (AWS/GCP/Azure IAM, logging, encryption) and how they map to control requirements.\nSolid working knowledge of SOC 2, ISO 27001 (and ideally 27017/27701), and HIPAA control requirements, and the ability to map controls across frameworks to avoid duplicated evidence work.\nComfort with scripting or light development (Python, JavaScript, or similar) to build integrations, automate evidence pulls via API, or extend GRC tooling.\nStrong written communication; you can document a control, a gap, and a remediation plan clearly enough that an external auditor and an internal engineer both understand it.\nA stakeholder-centric mindset: you measure success by how easy it is for engineers to stay compliant, not just by how quickly GRC can produce evidence.\nDemonstrated ability to trace a control failure or audit finding back to its root cause and drive a durable fix across teams.\nLegally eligible to work in the U.S. on an ongoing basis.\nCurrent US Perks & Benefits:\nEmployer subsidized medical/vision and dental coverage for full-time employees\n401k Match to help you save for your future (50% of your contribution up to the first 6% of your eligible pay)\nMonthly stipend to support your work and productivity\nFlexible Time Away Program, plus Sick Time Off\nUS employees are automatically covered under Smartsheet-sponsored life insurance, short-term, and long-term disability plans\nUS employees receive 12 paid holidays per year\nUp to 24 weeks of Parental Leave\nPersonal paid Volunteer Day to support our community\nOpportunities for professional growth and development including access to Udemy online courses\nCompany Funded Perks, including a counseling membership, local retail discounts, and your own personal Smartsheet account\nTeleworking options from any registered location in the U.S. (role specific)\nSmartsheet provides a competitive base salary range for roles that may be hired in different geographic areas we are licensed to operate our business from. Actual compensation is determined by several factors including, but not limited to, level of professional, educational experience, skills, and specific candidate location. In addition, this role will be eligible for a market competitive incentive opportunity.\nUS Base Salary Pay Range\n$145,000—$193,750 USD\nGet to Know Us:\nAt Smartsheet, your ideas are heard, your potential is supported, and your contributions have real impact. You’ll have the freedom to explore, push boundaries, and grow beyond your role. We welcome diverse perspectives and nontraditional paths-because we know that impact comes from individuals who care deeply and challenge thoughtfully. When you’re doing work that stretches you, excites you, and connects you to something bigger, that’s magic at work. Let’s build what’s next, together.\nEqual Opportunity Employer:\nSmartsheet is an Equal Opportunity (EEO) employer committed to fostering an inclusive environment with the best employees. It is our policy to provide equal employment opportunities to all qualified applicants in accordance with applicable laws in the US, UK, Australia, Germany, Costa Rica, Japan, Bulgaria, India, and Singapore. All qualified applicants will receive consideration without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veteran or disabled status, or genetic information. \nIf there are preparations we can make to help ensure you have a comfortable and positive interview experience, please let us know.","description_format":"text","description_chars":7964,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Life insurance","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Project & Work Management Software"],"lifecycle":[{"event":"open","at":"2026-09-29T01:16:59Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 33 · green card filings: 18","filings_12m":33,"filings_prev_12m":44,"green_card_filings_12m":18,"median_offered_wage_usd":163088,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":16,"expected_fill_days":57,"reasons":["conf:1","stale_co","velocity","win:early"],"computed_at":"2026-10-15T05:46:00Z"},"pay":{"stated_usd_annual":193750,"is_top_pay":true},"html_url":"https://alion.io/job/smartsheet-commercial-grc-engineer-sr-security-engineer-i","json_url":"https://alion.io/job/smartsheet-commercial-grc-engineer-sr-security-engineer-i.json","meta":{"generated_at":"2026-10-15T12:53:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19859,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1678},"rest":"https://alion.io/mcp/rest/get_company?id=1678"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsmartsheet-commercial-grc-engineer-sr-security-engineer-i"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsmartsheet-commercial-grc-engineer-sr-security-engineer-i"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsmartsheet-commercial-grc-engineer-sr-security-engineer-i"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/smartsheet-commercial-grc-engineer-sr-security-engineer-i\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsmartsheet-commercial-grc-engineer-sr-security-engineer-i"}]}