Senior GRC Automation Engineer

Bachelor’s degree in a relevant field such as law, information security, computer science, information systems, or a related discipline, or equivalent practical experience.

8+ years of experience in security, privacy, risk, compliance, governance engineering, or a related technical program role, including meaningful experience designing or operating scalable compliance or control processes.

Proven experience as a senior individual contributor in a technical GRC, security engineering, compliance engineering, or control automation capacity.

Strong knowledge of security and compliance frameworks such as NIST, ISO 27xxx, PCI DSS, SOC 2, and privacy requirements, with the ability to map obligations to technical controls and operational evidence.

Demonstrated experience with GRC platforms and supporting technologies, including platform configuration, workflow design, integrations, and reporting.

Strong technical fluency across areas such as cloud environments, application security, identity and access management, logging and monitoring, data protection, and control implementation patterns.

using automation and scripting to streamline security and compliance processes; familiarity with technologies such as SQL, Python, PowerShell, or similar tooling is strongly preferred.

Ability to analyze complex systems, reverse engineer workflows where needed, and translate technical realities into compliance narratives, control designs, and actionable remediation plans.

Excellent communication, stakeholder management, and influencing skills, with the ability to work effectively across technical and non-technical teams and drive outcomes without direct authority.

building metrics and using data to inform decisions, track progress, and demonstrate program maturity is strongly preferred.

Relevant certifications such as CISSP, CISM, CISA, CRISC, GRCP, PCIP, or comparable credentials are preferred.

Experience designing continuous controls monitoring or engineering-led compliance evidence strategies in cloud-native environments.

partnering closely with engineering organizations to build scalable, automated compliance capabilities rather than relying primarily on manual assessment methods.

Safely integrates and operates AI/ML‐enabled solutions that improve outcomes, such as enhanced monitoring, automated controls testing, or intelligent risk detection in digital environments.

Advanced experience applying AI/ML concepts to assess, manage, and mitigate compliance risks within complex technical ecosystems, including governance of AI-driven products and workflows

Accommodation requests

Expedia Group is committed to providing an inclusive and accessible recruiting experience.

If you need an accommodation or adjustment due to a disability during the application or recruiting process, please submit a request at https://expedia.service-now.com/askeg?id=job_accommodation.

Expedia Group includes three flagship consumer brands - Expedia, Hotels.com, and Vrbo - along with a leading B2B travel business and travel advertising offerings.

Across our brands and business, we help travelers explore the world with confidence and ease.

Important notice

Employment opportunities and job offers at Expedia Group will always come from Expedia Group's Talent Acquisition and hiring teams.

Never share sensitive personal information unless you are confident of the recipient.

Expedia Group does not extend job offers via email or messaging tools to individuals with whom we have not made prior contact.

Our email domain is @expediagroup.com.

The official place to find and apply for roles is https://careers.expediagroup.com/jobs/.