Senior GRC Engineer at Align Technology

<h4><strong>About the Role&nbsp;</strong></h4> <p>The Senior GRC Engineer owns audit evidence collection and technical control maintenance across A-LIGN's growing portfolio of compliance frameworks, including FedRAMP Moderate Equivalency, FedRAMP 20x, ISO 27001, ISO 42001, and SOC 2. This role bridges the GRC function and A-LIGN's technical teams, working hands-on in GCP, GitHub, and Microsoft 365 to collect evidence, verify controls, and keep A-LIGN continuously audit-ready. The Senior GRC Engineer works cross-functionally with every technical department in the company to reduce audit burden on engineering and IT while protecting the certifications that A-LIGN's clients and platforms depend on. The role also supports broader information security activities, including risk assessments, threat modeling, security reviews, and AI technical safeguards.</p> <h4><strong>Reports to</strong></h4> <p>Chief Information Security Officer</p> <h4><strong>Pay Classification</strong></h4> <p>Full-Time&nbsp;</p> <h4><strong>Responsibilities&nbsp;</strong></h4> <ul> <li>Own end-to-end audit evidence collection, validation, and organization across A-LIGN's compliance frameworks, including FedRAMP (Moderate Equivalency and FedRAMP 20x), ISO 27001, ISO 42001, SOC 2, NIST 800-53, and NIST 800-171</li> <li>Maintain and continuously verify technical controls across A-LIGN's cloud and corporate environments, including Google Cloud Platform (GCP/GKE), GitHub, and Microsoft 365/Entra ID</li> <li>Serve as the primary liaison between the GRC function and technical departments (IT, Engineering, DevOps) to gather evidence, validate control implementation, and reduce audit burden on those teams</li> <li>Support FedRAMP continuous monitoring activities, including Key Security Indicator (KSI) evidence, vulnerability scan artifact collection, POA&amp;M tracking, and assessor (3PAO) requests</li> <li>Build and maintain evidence automation, including integrations between GRC tooling and source systems (identity provider, cloud platforms, code repositories, ticketing, endpoint management) to reduce manual collection effort</li> <li>Support A-LIGN's ISO 42001 Artificial Intelligence Management System (AIMS), including AI risk register evidence, AI control monitoring, and nonconformity remediation tracking</li> <li>Prepare audit-ready evidence packages and coordinate directly with external assessors and certification bodies during assessment windows</li> <li>Monitor control health between audit cycles, identify control drift or failures, and drive remediation with control owners before findings occur</li> <li>Maintain compliance documentation, including control narratives, policies, and procedures</li> <li>Support supplier and vendor security reviews with framework-specific evidence requirements</li> <li>Track framework changes (FedRAMP 20x requirements, ISO standard revisions, SOC 2 criteria updates) and translate them into actionable control and evidence updates</li> <li>Conduct security risk assessments and contribute to A-LIGN's corporate risk management program and risk register</li> <li>Participate in threat modeling for A-SCEND features, internal systems, and AI use cases, and translate findings into control improvements</li> <li>Perform security reviews of new tools, vendors, and internal initiatives, including support for Vendor Review Board activities</li> <li>Implement and validate AI technical controls and safeguards, including data loss prevention, AI connector and agent governance, and acceptable use enforcement, in support of A-LIGN's AI Management System</li> <li>Report compliance posture, evidence status, and audit readiness metrics to the CISO and GRC leadership</li> </ul> <h4><strong>Minimum Qualifications&nbsp;</strong></h4> <p>EDUCATION&nbsp;</p> <ul> <li>Bachelor's degree in information systems, cybersecurity, business, or equivalent combination of education and experience</li> </ul> <p>EXPERIENCE&nbsp;</p> <ul> <li>5+ years of experience in information security, GRC, IT audit, or compliance engineering roles</li> <li>Hands-on experience with audit evidence collection and technical control validation for at least one of the following required: FedRAMP, GovRAMP, NIST 800-53, or NIST 800-171</li> <li>Additional experience with ISO 27001, ISO 42001, or SOC 2 preferred but not required</li> <li>DevSecOps or cloud engineering experience sufficient to independently locate and extract evidence from GCP, GitHub, and Microsoft 365/Entra ID environments</li> <li>Experience with GRC platforms and evidence automation (AuditBoard, Vanta, Drata, or similar)</li> <li>Experience supporting external audits and assessor interactions, including 3PAO assessments</li> <li>Working knowledge of vulnerability management, CI/CD pipelines, infrastructure-as-code, and identity and access management concepts</li> <li>Experience scripting or automating evidence collection (Python, PowerShell, or similar) preferred</li> <li>Familiarity with risk assessment methodologies, threat modeling (e.g., STRIDE), and security review processes preferred</li> </ul> <p>CERTIFICATIONS &nbsp;</p> <ul> <li>CISA, CISSP, CCSK/CCSP, ISO Lead Auditor/Implementer, or relevant certifications preferred but not required</li> </ul> <p>SKILLS&nbsp;</p> <ul> <li>Strong cross-functional collaboration and project management skills</li> <li>Ability to translate framework requirements into clear, actionable requests for technical teams</li> <li>Highly organized with the ability to manage evidence deadlines across multiple concurrent audit cycles</li> <li>Excellent written communication for control narratives, evidence descriptions, and assessor responses</li> <li>Self-directed with strong follow-through in a fast-paced, deadline-driven environment</li> <li>Proven experience utilizing AI tools to automate manual tasks, streamline workflows, and increase team efficiency</li> <li>Experience operating in PE-backed or high-growth environments preferred</li> </ul> <h4><strong>Benefits&nbsp;</strong></h4> <ul> <li>Employer Paid Life &amp; Health Insurance&nbsp;</li> <li>Competitive Bonus Structure&nbsp;</li> <li>Home Office Reimbursement&nbsp;</li> <li>Technology Allowance&nbsp;</li> <li>Certification Reimbursement&nbsp;</li> <li>BeneficiaT&nbsp;Discount Loyalty Program&nbsp;</li> <li>Personalized Career Coaching&nbsp;</li> <li>Generous Paid Time Off&nbsp;</li> <li>Paid Office Closure December 25-January 1&nbsp;</li> <li>Summer Hours&nbsp;</li> </ul> <h4><strong>About A-LIGN&nbsp;</strong></h4> <p>A-LIGN is the leading provider of high-quality, efficient cybersecurity compliance programs. Combining experienced auditors and audit management technology, A-LIGN provides the widest breadth and depth of services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. A-LIGN is the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor. To learn more, visit a-lign.com.&nbsp;</p> <h4><strong>Come Work for A-LIGN!&nbsp;</strong></h4> <p>Apply online today at A-LIGN.com and learn about life at A-LIGN by following us on&nbsp;<strong><a href="https://www.linkedin.com/company/a-lign/posts/?feedView=all">LinkedIn</a>.&nbsp;&nbsp;</strong></p> <p>A-LIGN is an Equal Opportunity Employer.</p>