Associate GRC Engineer (Remote, United States)

About Nearshore Cyber
Nearshore Cyber delivers cybersecurity work with teams in the United States and Mexico. This role is part of its GRC services business.

The role
GRC Engineers at Nearshore Cyber build the automation that keeps a governance, risk, and compliance program true: controls kept as code, evidence pulled from live systems, and monitoring that runs continuously instead of once a quarter. You will work with client security, platform, and audit teams on programs such as SOC 2, ISO/IEC 27001, NIST SP 800-53, FedRAMP, and CMMC. You build and maintain the automated checks and evidence collectors that keep a client's compliance program current, working alongside senior GRC engineers.

Location
Remote, United States. You must be authorized to work in the United States.

What you will do

• Build and maintain automated evidence collection from cloud, identity, human resources, and ticketing systems through their APIs.
• Write and test automated control checks and policy-as-code rules (for example, Open Policy Agent or HashiCorp Sentinel) under the guidance of senior engineers.
• Map controls to framework requirements and keep the control library current in version control.
• Investigate failed checks and configuration drift, and route each failure to the owner who can fix it.
• Prepare system-generated evidence for audits and customer security reviews.

What you bring

• 2 or more years in GRC, IT audit, security operations, or cloud engineering.
• Scripting in Python or a similar language, and daily use of Git.
• Working knowledge of at least one framework: SOC 2, ISO/IEC 27001, or NIST SP 800-53.
• Familiarity with AWS, Azure, or Google Cloud.
• Clear written communication.

Nice to have

• Terraform or another infrastructure-as-code tool.
• Experience with a compliance automation platform.
• SQL.

Nearshore Cyber is an equal opportunity employer.