{"id":4221078,"url":"https://alion.io/job/treasure-data-security-engineer-grc","title":"Security Engineer, GRC","company":{"id":180505,"name":"Treasure Data","domain":"treasure.ai","url":"https://alion.io/company/treasure-data","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Schema","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"Claude Code","optional":false},{"name":"Confluence","optional":false},{"name":"Cursor","optional":false},{"name":"GitHub Actions","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"Jira","optional":false},{"name":"LLM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Slack","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-09-30T20:00:02Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-11-13T04:59:55Z","board_verified":true,"closed_at":null,"days_open":43,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":43},"description":"Treasure AI:\nTreasure AI is the agentic experience platform built to acquire, retain, and grow your most valuable customers. Powered by AI, Treasure AI is shaped by human creativity and always-on through continuous, context-driven action.\nFurthermore, Treasure AI employees are enthusiastic, data-driven, and customer-obsessed. We are a team of drivers-self-starters who take initiative, anticipate needs, and proactively jump in to solve problems. Our actions reflect our values of honesty, reliability, openness, and humility.\nYour Role:\nTreasure AI is hiring a Security Engineer, GRC to architect, build, and automate the systems that power our Trust & Assurance (T&A) program. The right person for this role gets frustrated by manual compliance work - not because it's beneath them, but because they know it doesn't have to exist.\nThis role sits at the intersection of security engineering and GRC. You will design, operate, and maintain the systems that make compliance continuous, visible in real-time, and GRC insights actionable. You will treat the GRC platform as a programmable surface, extend it via APIs and agent workflows, and integrate it with the rest of Treasure AI's tech stack.\nYou will work closely with GRC Specialists, taking program requirements and translating them into technical implementations - automations, integrations, dashboards, guardrails, and tooling. You will also work directly with Security, IT, Engineering, and Product teams to embed compliance into the systems and pipelines they already use.\nAI fluency is a baseline expectation. You will use agentic tools to accelerate your own work and will build AI-powered automations into GRC workflows - from evidence ingestion to questionnaire response to executive reporting.\nResponsibilities & Duties:\nBuild AI agent workflows (using Claude, MCP integrations, or similar) to automate repeatable GRC tasks.\n\nConfigure and maintain the technical configuration and extension of our GRC platform - architect data relationships, configure control workflows, build custom rules, and extend the platform via APIs and webhooks rather than relying on the default UI.\n\nBuild automated executive readout workflows so monthly and quarterly GRC reporting is a 30-minute review, not a multi-day build.\n\nDesign and operate automated evidence collection pipelines and continuous control monitoring - pulling signals directly from source systems in real time so drift is surfaced before audit time, not during it.\n\nTranslate controls into testable, codified checks. Identify gaps in compliance coverage across CI/CD pipelines and IaC (Terraform) and contribute compliance logic where gaps exist.\n\nEmbed lightweight compliance checkpoints into design review workflows, ensuring control-relevant changes are flagged before deployment.\n\nSupport FAIR-informed quantitative risk modeling with data pipelines and tooling that make risk scenarios computable rather than narrative-only.\n\nBuild and maintain automation for the TPRM lifecycle - vendor intake, risk scoring, questionnaire distribution, evidence analysis, and remediation tracking - using AI-assisted tooling to reduce per-vendor manual effort.\n\nBuild tooling and dashboards that give the GRC Specialist and business stakeholders a continuous view of privileged access, access exceptions, and open remediation items - replacing point-intime UAR reports with an always-on IGA posture.\n\nBuild and maintain automation across the customer trust surface - AI-assisted questionnaire response pipelines, RFP contribution workflows, and trust center content management - so customer assurance accelerates deals rather than bottlenecking them.\n\nBuild automation across the security awareness and training lifecycle - detecting end-user risk signals or policy violations to improve the culture of security.\n\nRequired Qualifications:\nAt least 3+ years in Security Engineering, DevSecOps, Technical GRC, or a closely adjacent function - with a demonstrably strong engineering track record in automation and tooling, not just program ownership.\n\nStrong coding foundation: proficient in Python and/or TypeScript, comfortable calling REST APIs, handling JSON/YAML payloads, building webhooks, and shipping integrations from scratch without hand-holding or assistance. You treat Jira, Confluence, Slack, and similar enterprise tools as systems to integrate with, not just UIs to click through.\n\nHands-on experience building automation and integrations in enterprise environments - not just configuring OOTB features, but writing code to extend or connect systems.\n\nPractical hands-on experience with a modern GRC platform (Vanta, anecdotes, Drata, Secureframe, or similar) - you've configured custom workflows, written rules, and used the APIs; not just the UI.\n\nWorking knowledge of SOC 2, ISO 27001/17/18, ISO 42001 and HIPAA - enough to read a control and determine how to test it programmatically.\n\nDemonstrated experience shipping AI-assisted automation: agent workflows, prompt pipelines, LLM-integrated integrations, or similar. Comfort with agentic coding tools (Claude Code, Cursor, or equivalent).\n\nFamiliarity with the AWS security control surface (IAM, CloudTrail, Config, GuardDuty) and how to consume compliance signals via API; working knowledge of CI/CD workflows (GitHub Actions or similar) and IaC (Terraform or equivalent) - you understand where compliance checks can be embedded in a deployment pipeline.\n\nStrong collaboration and written communication skills - able to work across multiple Security domains, IT, Engineering, Legal/Privacy, and GTM, and able to write clear technical documentation.\n\nTravel Requirements:\nAnnual team on-site in the US/CAN (total travel: \nPerks and Benefits (US):\nOur benefit package showcases our culture of care and empathy with\nComprehensive medical, dental, vision plans and Employee Assistance Program (EAP)\n\nCompetitive compensation packages\n\nCompany paid life insurance 3x salary\n\nCompany paid short- and long-term disability coverage\n\nRetirement planning (401K) with 4% company match\n\nRestricted Stock Units (RSU)\n\nFlexible Time Off (FTO)\n\nUp to 26 weeks paid parental leave including a post-partum night nurse\n\nComprehensive support and access to care for everyone, everywhere through Carrot - our global reproductive health and family-building benefit.\n\nOur Dedication to You:\nWe value and promote diversity, equity, inclusion, and belonging in all aspects of our business and at all levels. Success comes from acknowledging, welcoming, and incorporating diverse perspectives.\nDiverse representation alone is not the desired outcome. We also strive to create an inclusive culture that encourages growth, ownership of your role, and achieving innovation in new and unique ways. Your voice will be heard, and we will help amplify it.\nAgencies and Recruiters:\nWe cannot consider your candidate(s) without a contract in place. Any resumes received without having an active agreement will be considered gratis referrals to us. Thank you for your understanding and cooperation!\nThis description captures the core of the role today. As we adopt AI and new ways of working, responsibilities may evolve, and we encourage team members to take initiative, lean into change, and help expand the impact of their role beyond what’s listed here.","description_format":"text","description_chars":7299,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Flexible time off","Life insurance","Parental leave","Restricted stock units","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Marketing Automation","Customer Data Platforms (CDP) & Reverse ETL"],"lifecycle":[{"event":"open","at":"2026-11-13T04:59:55Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 6 · green card filings: 1","filings_12m":6,"filings_prev_12m":12,"green_card_filings_12m":1,"median_offered_wage_usd":148929,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":59,"band":"ok","label":"Likely open","p_open":1,"p_active":0.783,"p_room":0.75,"age_days":43,"expected_fill_days":49,"reasons":["conf:0","win:late"],"computed_at":"2026-11-13T05:48:00Z"},"pay":null,"html_url":"https://alion.io/job/treasure-data-security-engineer-grc","json_url":"https://alion.io/job/treasure-data-security-engineer-grc.json","meta":{"generated_at":"2026-11-13T05:48:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12255,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":180505},"rest":"https://alion.io/mcp/rest/get_company?id=180505"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftreasure-data-security-engineer-grc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftreasure-data-security-engineer-grc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftreasure-data-security-engineer-grc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/treasure-data-security-engineer-grc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftreasure-data-security-engineer-grc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4221078}},{"tool":"search_jobs","arguments":{"company":"treasure.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4221078},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}