GRC Engineer

Evidence & controls platform

Build the pipelines and integrations that aggregate control, asset, and identity data across our stack (cloud, IdP, HRIS, source control, CI/CD) and turn it into automated checks, live dashboards, and audit evidence.

Implement the unified controls library so one control satisfies many frameworks, with evidence collected once and mapped everywhere.

Ingest from what partners already own — Corporate Security’s technical controls, the SaaS portfolio’s system of record — rather than building parallel collectors; system owners keep their evidence, your platform makes it audit-ready.

Build the technical evidence base for our AI certifications (ISO/IEC 42001 and emerging AI-agent assurance standards): agent action logging, evaluation evidence, tool-call restrictions, and failure-mode documentation, working with Product and Engineering.

Continuous assurance & agentic workflows

Translate written policies and regulatory requirements into enforceable rules: automated checks in CI/CD and infrastructure deployment, continuous controls monitoring, and drift alerts routed to owners.

Instrument control effectiveness so the GRC Lead reports risk posture from live data.

Design and run agentic workflows for evidence analysis, control testing, and audit response preparation, with a human in the loop where assurance demands it. Anything manual twice a quarter gets automated.

6-8+ years spanning software or automation engineering and security compliance — an engineer who learned GRC, or a GRC operator who became a builder.

Production-grade scripting (Python or similar) against APIs — code you ship and own.

Hands-on experience building LLM/agent workflows and daily use of AI in your own work, with grounded judgment on what to delegate to agents, what needs a human, and how to evidence both to an auditor.

Enough GRC domain fluency to work inside SOC 2 / ISO 27001 control language and know what an auditor will accept as evidence.

Clear technical writing — your evidence and documentation will be read by auditors and customer security teams.

Experience with compliance platform APIs and when to build past them.

OSCAL or other machine-readable control/catalog formats.

Infrastructure-as-code (Terraform or similar) and CI/CD pipeline engineering.

Prior work on AI product assurance: evals, red-teaming evidence, or model/agent documentation.

Global collaboration: Partner with teams and clients across Europe, APAC, and North America.

Competitive package: Comprehensive salary, benefits, and tools for success.

Meaningful work: Your efforts shape how thousands of lawyers use AI daily.

In-person environment: Union Square office designed for ambitious builders and company provided lunch daily.

Benefits & Perks: We invest in our people with a comprehensive, thoughtfully designed benefits package: Medical, Dental & Vision

Multiple medical plan options through Aetna and Kaiser Permanente

HSA or Healthcare FSA (based on plan selection)

Dental plans via MetLife

Vision plans via Vision Care

Family Support

Generous parental leave

Free access to Maven Clinic

Dependent Care FSA

Free One Medical membership for employees and dependents

Additional Perks

Pre-tax commuter benefits

Life Insurance + STD/LTD

401(K) with generous company match

Unlimited PTO

Robust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more

Legora is an Equal Opportunity Employer

At Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.