Senior Information Security Engineer (GRC)

About the Role

As an Information Security Engineer focused on Governance, Risk, and Compliance (GRC) at Clutch, you will own and mature our trust foundation. You will operationalize our security controls, drive evidence collection and continuous monitoring, and partner with product, engineering, and business teams to reduce risk while enabling speed.

Responsibilities

• Baseline our control library mapped to SOC 2, PCI DSS, and key fintech obligations, identifying and assigning remediation owners.
• Implement lightweight evidence collection pipelines for critical controls such as access reviews, backup tests, vulnerability management, and CI/CD change management.
• Complete a security risk register refresh with likelihood and impact ratings, and publish quarterly risk reports.
• Lead our next SOC 2 Type II audit cycle end-to-end, including auditor coordination, population requests, and walkthroughs.
• Roll out a vendor risk management workflow integrated with procurement and Legal, covering tiering, due diligence, and continuous monitoring.
• Partner with Engineering to define secure SDLC checkpoints and automate evidence from GitHub, CI, and cloud environments.
• Drive PCI DSS certification readiness, including SoA ownership, internal audits, and management review inputs.
• Establish KPI/KRIs and dashboards for control effectiveness and risk trends, consumable by executives and customers.
• Mature incident response playbooks and conduct cross-functional tabletops with measurable improvements.

Requirements

• 5+ years of experience in GRC, security engineering, or risk management within SaaS or fintech environments.
• Proven experience running SOC 2 Type II audits and working toward ISO 27001, including evidence automation and auditor interactions.
• Strong understanding of cloud security controls across AWS, containerized workloads, and modern CI/CD practices.
• Practical knowledge of secure SDLC, vulnerability management, identity and access management (IAM), and third-party risk management.
• Ability to translate security requirements into actionable, ticketed work with clear owners and due dates.
• Excellent written communication skills for policies, customer questionnaires, and executive-level reporting.

Nice-to-Haves

• Experience with privacy programs, PCI readiness, or financial services regulations.
• Relevant certifications such as CISA, CISSP, or ISO 27001 Lead Implementer/Lead Auditor.