GRC Engineer

New York, NY · San Francisco · 3-6 years experience · Full-time · Onsite · Posted Oct 9, 2026

At a glance

Reflection AI is seeking a GRC Engineer to build and maintain the technical infrastructure, tooling, pipelines, automated controls, and evidence collection that lets the compliance program operate at engineering scale.
This role sits at the intersection of compliance and engineering, partnering closely on technical controls required by Security frameworks, AI Governance frameworks, Privacy, and Data Governance pillars to translate policy requirements into technical controls.

Design and build automated controls and monitoring that satisfy security framework requirements (SOC 2, ISO 27001, NIST 800-53/800-171, CMMC): access reviews, data minimization, model/data lineage, continuous evidence collection
Partner with Engineering, Security, and IT to implement technical requirements arising from security frameworks, deemed export controls, and privacy regulations
Build and maintain internal tooling that supports compliance workflows (intake forms, screening checks, reporting dashboards, GRC platform integrations such as Vanta)
Translate regulatory and policy requirements into concrete technical specifications engineering teams can implement
Support technical due diligence for inbound customer security questionnaires, audits, and outbound vendor assessments
Maintain integrations between compliance/GRC systems and source-of-truth systems (identity, data infrastructure, model pipelines)
Help scope and support technical environment separations or system boundaries required for regulatory compliance (e.g., subsidiary or enclave environments)

3-6 years of software engineering, security engineering, or DevOps/infrastructure experience
Hands-on experience supporting at least one security framework (SOC 2, ISO 27001, or NIST) as an engineer, not just as a subject
Comfortable writing production-quality code (Python, or similar) and working with APIs/integrations
Experience translating non-technical requirements (policy, regulatory, contractual) into technical implementation
Familiarity with cloud infrastructure and identity/access management concepts
Strong collaboration skills; able to work effectively with compliance, legal, and engineering stakeholders who don't share a common vocabulary

Top-tier compensation: Salary and equity structured to recognize and retain our talent globally
Stock options
Comprehensive medical, dental, vision, and life, with an annual wellness allowance
Lunch and dinner provided in the office daily
22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys
Unlimited paid time off in the U.S. and 30 days in the U.K.
Sponsorship support
Regular off-sites, happy hours, and team celebrations