Security Engineer, GRC

Plaid, Remote United States +3

The role

You will own GRC Engineering at Plaid – a foundational, high-ownership role defining an emerging discipline from the ground up. Today most of our compliance work is manual and point-in-time; you will turn it into an engineered system that is continuous, data-driven, and scalable, and set the technical direction for the field.
You will:
Define the discipline and the architecture — how GRC Engineering works at Plaid, not just execute within it.
Build the foundation the function runs on — a codified source of truth for controls, policies, and evidence, fed by live pipelines and continuous controls monitoring.
Be the engineering backbone for Security Assurance & Trust Enablement, Third-Party Ecosystem Risk, and Risk Management
Make risk visible and data-driven — turning control and risk data into real-time signals for the team and leadership.
Pioneer where compliance is heading – compliance-agents-as-code in the SDLC, AI- and agent-driven workflows, and machine-readable continuous compliance (FedRAMP 20x).

All jobs

Security Engineer, GRC

Plaid, Remote United States +3

The role

You will own GRC Engineering at Plaid – a foundational, high-ownership role defining an emerging discipline from the ground up. Today most of our compliance work is manual and point-in-time; you will turn it into an engineered system that is continuous, data-driven, and scalable, and set the technical direction for the field.
You will:
Define the discipline and the architecture — how GRC Engineering works at Plaid, not just execute within it.
Build the foundation the function runs on — a codified source of truth for controls, policies, and evidence, fed by live pipelines and continuous controls monitoring.
Be the engineering backbone for Security Assurance & Trust Enablement, Third-Party Ecosystem Risk, and Risk Management
Make risk visible and data-driven — turning control and risk data into real-time signals for the team and leadership.
Pioneer where compliance is heading – compliance-agents-as-code in the SDLC, AI- and agent-driven workflows, and machine-readable continuous compliance (FedRAMP 20x).

What you need

Software & Data Engineering Foundations:
Strong Python and SQL, with a proven track record of building API/webhook integrations that connect disparate systems.
Experience owning an internal tool or service end to end — design, build, operate, and maintain — with real users depending on it.
Hands-on experience with AWS and cloud-native security controls, including the ability to query cloud, GitHub, and SaaS logs.
Proficiency with dashboarding / data-visualization tools (e.g., Mode) to turn control and risk data into KPIs and signal.
Applied GRC Engineering:
Experience building and operating continuous controls monitoring end to end — collecting signal from live systems, writing and tuning the detection logic that compares state to a baseline, alerting, and driving remediation.
Demonstrated ability to model controls, policies, and framework mappings as structured, version-controlled data rather than docs and spreadsheets.
Hands-on experience with IaC (Terraform) and policy-as-code (OPA/Rego, Sentinel), including embedding compliance checks into CI/CD.
Proven ability to eliminate recurring operational toil — evidence pulls, access and vendor reviews, questionnaires, risk-register upkeep, status reports — with durable automation rather than one-off scripts.
Compliance & risk knowledge:
Working knowledge of SOC 2, ISO 27001/27701, and NIST CSF/800-53, with the ability to map controls to evidence and crosswalk a single control across frameworks.
Experience conducting security or technology risk assessments and translating findings into data-driven mitigation.
Familiarity with the shift to continuous compliance (FedRAMP 20x, machine-readable Key Security Indicators) and how it changes evidence and control design.
AI fluency & tooling:
Demonstrated ability to build and scale agentic / AI-assisted workflows (Claude, OpenAI) as leverage for the whole team.
Cross-functional effectiveness:
Ability to work independently and cross-functionally across security, infrastructure, and engineering, with strong prioritization and the ability to influence without authority.

Security Engineer, GRC

The role

Security Engineer, GRC

The role

What you will do

What you need

Nice to have

About Plaid

Similar jobs at other companies

Senior Security Engineer - GRC

Senior GRC Engineer

Senior GRC Engineer

Senior Security GRC Lead

Security GRC Engineer

Security GRC Lead

Plaid