GRC Engineer

About the role

Forward was founded in 2013 by four Stanford Ph.D.s to build the industry's first network digital twin, enabling engineers and AI agents to know the impact of every change before it touches production. The company’s founding instinct—accuracy, evidence‑driven clarity, and a preference for certainty over comfort—still defines how it works. Forward’s platform is trusted by global leaders such as Goldman Sachs, PayPal, S&P Global, IBM, and Dell, delivering an average of $14.2 M in annual benefits per IDC. Backed by top‑tier investors and headquartered in Santa Clara, Forward is proud of its team of curious builders. The GRC Engineer role represents a new discipline: instead of chasing screenshots for quarterly audits, you will build scripts and API integrations that pull evidence directly from source systems and keep it current. Your initial focus (≈6 months) is GRC Engineering—compliance automation, audit management (SOC 2, ISO 27001/42001), control design and testing, and risk management. Once core automations are in place, the role expands to include Security Operations work: SIEM/SOAR administration, alert triage, incident response, and related endpoint support.

Responsibilities

• Write, maintain, and actively drive review cycles for security policies and procedures.
• Build control tests that verify real system configurations directly at the source (e.g., confirm MFA enforcement in the identity provider).
• Manage and extend the GRC platform (Vanta, Drata, etc.) using scripts and API integrations.
• Continuously manage control drift between audits and drive remediation to completion.
• Lead day‑to‑day SOC 2 Type II audits and lay groundwork for ISO 27001 and ISO 42001.
• Maintain a prioritized risk register and run actionable risk assessments.
• Handle vendor security reviews and due diligence by pulling evidence from a vendor’s API or trust page instead of mailing spreadsheets.
• Integrate compliance requirements directly into engineering workflows (CI/CD, access provisioning, change management).
• Tune detection rules, correlation logic, and response playbooks in SIEM & SOAR.
• Assist with EDR, DLP, and endpoint break/fix and incident response cases.
• Participate in security alert triage and documentation.
• Jump into incident response: investigation, containment, and post‑mortem write‑ups.
• Feed SOC observations back into the GRC side to identify gaps between compliance platform reports and operational reality.

Requirements

• 3+ years in GRC, compliance, security engineering, IT audit, or equivalent, with on‑the‑job exposure to control design, risk assessment, AND compliance frameworks.
• Experience writing policies and procedures with a focus on testable and verifiable outcomes.
• Time spent doing real work in a GRC/compliance automation platform (Vanta, Drata, Thoropass, Anecdotes, or similar).
• Solid working knowledge of SOC 2; ISO 27001 experience is a plus; ISO 42001 is a possible future endeavor, but curiosity about AI governance is important.
• Basic scripting knowledge: Python or Bash, SQL, and comfort pulling data from an API, parsing a log file, or automating manual tasks.
• Ability to read, troubleshoot, and deliver working scripts (AI assistance allowed).
• Some exposure to SIEM/SOAR tooling (Splunk, Chronicle, Panther, XSOAR, Tines, etc.) and a basic feel for how incident response runs.
• Ability to speak to an auditor and an engineer in languages they understand.
• Tolerance for ambiguity; the GRC Engineer role is evolving.
• Experience with endpoint compliance in a Mac‑centric environment.

Skills

• Comfort with straight Linux administration and scripting (relevant for both cloud‑native and on‑prem data‑center work).
• Experience with Terraform or policy‑as‑code.
• Certifications such as Security+, CISA, CISSP, or ISO 27001 Lead Implementer/Auditor are nice to have.
• Experience tuning or migrating a SIEM/SOAR setup, or running incident response for real (not just tabletop).
• Understanding how to run tabletop exercises, conduct post‑mortems, and drive findings to completion with stakeholders.

Pay

The base pay range for this role is between $140,000