Compliance Engineer

About the role

You will build the platform Legora’s assurance program runs on: pipelines that collect evidence continuously, checks that enforce policy in CI/CD, and agents that test controls and draft audit responses. The GRC Lead owns the program and the judgment calls; you own the machinery that turns certifications into an output of normal operations.

Responsibilities

• Build the pipelines and integrations that aggregate control, asset, and identity data across our stack (cloud, IdP, HRIS, source control, CI/CD) and turn it into automated checks, live dashboards, and audit evidence.
• Implement the unified controls library so one control satisfies many frameworks, with evidence collected once and mapped everywhere.
• Ingest from what partners already own — Corporate Security’s technical controls, the SaaS portfolio’s system of record — rather than building parallel collectors; system owners keep their evidence, your platform makes it audit-ready.
• Build the technical evidence base for our AI certifications (ISO/IEC 42001 and emerging AI-agent assurance standards): agent action logging, evaluation evidence, tool-call restrictions, and failure-mode documentation, working with Product and Engineering.
• Continuous assurance & agentic workflows: Translate written policies and regulatory requirements into enforceable rules: automated checks in CI/CD and infrastructure deployment, continuous controls monitoring, and drift alerts routed to owners.
• Instrument control effectiveness so the GRC Lead reports risk posture from live data.
• Design and run agentic workflows for evidence analysis, control testing, and audit response preparation, with a human in the loop where assurance demands it. Anything manual twice a quarter gets automated.

Requirements

• 6-8+ years spanning software or automation engineering and security compliance — an engineer who learned GRC, or a GRC operator who became a builder.
• Production-grade scripting (Python or similar) against APIs — code you ship and own.
• Hands-on experience building LLM/agent workflows and daily use of AI in your own work, with grounded judgment on what to delegate to agents, what needs a human, and how to evidence both to an auditor.
• Moderate GRC domain fluency to work inside SOC 2 / ISO 27001 control language and know what an auditor will accept as evidence.
• Clear technical writing — your evidence and documentation will be read by auditors and customer security teams.

Nice to have

• Experience with compliance platform APIs and when to build past them.
• OSCAL or other machine-readable control/catalog formats.
• Infrastructure-as-code (Terraform or similar) and CI/CD pipeline engineering.
• Prior work on AI product assurance: evals, red-teaming evidence, or model/agent documentation.

Qualifications

Commensurate with experience.

Skills

Not specified.

Benefits

See above.

Pay

TBD.

Schedule

TBD.