Sr. GRC Engineer
for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must only include sections when posting has real, specific content. We have:
- About the role: we have description of vision, team, role description. Could be "About the role". Should we include? Yes.
- Responsibilities: list of responsibilities bullet points.
- Requirements: Minimum Qualifications.
- Qualifications: Preferred Qualifications.
- Skills: maybe not separate; we could combine with qualifications. But we could have a Skills section if there is explicit skill list. There's proficiency in programming language, experience with APIs, CI/CD, etc. Could be considered Skills. However we already have Requirements (minimum qualifications) and Qualifications (preferred). Might be okay to have Requirements and Qualifications sections.
- Benefits: there is a Benefits paragraph.
- Pay: Base Pay Range For WA applicants is $156,802.00 - $219,522.45. Also mention other site ranges may differ. So we have pay info.
- Schedule: not mentioned. So we should not include Schedule.
We must not repeat job title as heading. No Job ID etc. Remove boilerplate: Application Close Date, Culture Statement, Export Control Regulations, Background Check, EEO, etc. Also remove duplicated lines.
We need to preserve all substantive information. So we need to include the description paragraphs about vision, Enterprise Technology, Cybersecurity GRC team, role description. Also responsibilities list. Minimum qualifications list. Preferred qualifications list. Benefits list. Pay range.
We must format using headings, - for lists,
for prose.
We need to decide what goes into each section.
About the role: could contain the introductory paragraphs: "At Blue Origin, we envision millions of people living and working in space for the benefit of Earth...". Also description of Enterprise Technology and Cybersecurity GRC team and role description. We'll combine into a few paragraphs.
Responsibilities: list each bullet from "Responsibilities Include But Are Not Limited To". We'll extract each line.
Requirements: Minimum Qualifications list.
Qualifications: Preferred Qualifications list.
Benefits: list from Benefits paragraph.
Pay: maybe a paragraph with base pay range.
We must not include fluff like "commensurate with experience". Not present.
We must not include duplicated lines.
Let's extract content.
Original text:
"Application Close Date Applications will be accepted on an ongoing basis until the requisition is closed. At Blue Origin, we envision millions of people living and working in space for the benefit of Earth. We’re working to develop reusable, safe, and low-cost space vehicles and systems within a culture of safety, collaboration, and inclusion. Join our team of problem solvers as we add new chapters to the history of spaceflight! This role is part of Enterprise Technology (ET), where we’re developing the digital infrastructure needed to build the road to space, with an emphasis on digital capabilities required to advance Blue Origin’s mission. Enterprise Technology is the center of excellence for digital technology at Blue Origin, providing oversight and governance to align technology and business strategies. The Blue Origin Cybersecurity GRC team is reducing the cost of security compliance through automation and engineering. This is primarily an engineering role: you will design, build, and operate the automation that makes compliance measurable, repeatable, and efficient, applying software and infrastructure engineering practices to the governance, risk, and compliance domains. It is well suited to software, SRE, platform, or DevOps engineers seeking to apply their automation expertise to security operations. Passion for our mission and vision is required!"
Then responsibilities list:
"Responsibilities Include But Are Not Limited To
Automating the collection of compliance artifacts and evidence across multiple cloud, SaaS, and internal platforms by integrating their APIs and normalizing the data.
Building and operating CI/CD pipelines and Compliance-as-Code so compliance content is version-controlled, tested, and validated automatically.
Automating configuration management and configuration monitoring - continuously validating system and platform configurations against approved baselines, detecting drift, and capturing results as evidence.
Supporting continuous monitoring by integrating and correlating security telemetry and findings from partner-team platforms (including vulnerability management and SIEM/observability) into control-status reporting.
Building GRC dashboards that integrate observability solutions to enable data-driven decisions.
Developing outcome-driven metrics and KPIs to measure control effectiveness.
Identifying manually intensive processes and engineering them away.
Supporting risk assessments and maintaining policies aligned with security frameworks."
Then Minimum Qualifications:
"Minimum Qualifications
7+ years building and operating production software or infrastructure automation (software, SRE, DevOps, platform, or security engineering).
Proficiency in a general-purpose programming language (Python strongly preferred; Go, JavaScript/TypeScript, or similar welcome), with maintainable, tested, version-controlled code.
Experience integrating disparate systems via REST APIs and automating data/evidence collection across multiple cloud and SaaS platforms.
Hands-on experience with CI/CD pipelines (e.g., GitLab CI) and infrastructure-as-code (Terraform, Bicep, or similar).
Experience with configuration management and configuration monitoring - config-as-code and continuous validation of system state against baselines, including drift detection.
Ability to translate ambiguous, multi-stakeholder requirements into reliable automation.
Aptitude and appetite to learn security compliance frameworks (NIST, ISO, CMMC); extensive prior GRC experience is not required.
Bachelor's degree or certification in a technical field, or equivalent experience."
Preferred Qualifications:
"Preferred Qualifications
Familiarity with GRC/compliance frameworks: NIST 800-53/800-171, ISO 27001, ISO 28000, SOC, CMMC, and privacy frameworks.
Compliance-as-Code / OSCAL / policy-as-code (OPA/Rego, InSpec) experience.
Configuration compliance and desired-state tooling (SCAP, CIS Benchmarks, Ansible, Salt, Chef/Puppet, or PowerShell DSC).
Continuous vulnerability monitoring - automating collection and correlation of findings from vulnerability management platforms (enterprise scanning is owned by a partner team).
SIEM / observability integration.
AI security experience.
Aerospace, manufacturing, or OT/safety-critical environment experience."
Pay:
"Base Pay Range For WA applicants is $156,802.00 - $219,522.45
Other Site Ranges May Differ"
Benefits:
"Benefits
Benefits include: Medical, dental, vision, basic and supplemental life insurance, paid parental leave, short and long-term disability, 401(k) with a company match of up to 5%, and an Education Support Program.Stock Options for all regular employees (working at least 20 hours/week)Paid Time Off: Up to four (4) weeks per year based on weekly scheduled hours, and up to 14 company-paid holidays.Dependent on role type and job level, employees may be eligible for benefits and bonuses based on the company's intent to reward individual contributions and enable them to share in the company's results, or other factors at the company's sole discretion. Bonus amounts and eligibility are not guaranteed and subject to change and cancellation. Please check with your recruiter for more details."
We need to format Benefits as list maybe. The paragraph includes many items separated by commas and periods. We can split into list items: Medical, dental, vision, basic and supplemental life insurance, paid parental leave, short and long-term disability, 401(k) with a company match of up to 5%, Education Support Program, Stock Options for all regular employees (working at least 20 hours/week), Paid Time Off: Up to four (4) weeks per year based on weekly scheduled hours, and up to 14 company-paid holidays. Also note about bonuses etc maybe not needed as it's not a guaranteed benefit; but we can include as prose.
We should not include the sentence about checking with recruiter maybe it's okay but it's not boilerplate? It's part of benefits description. We'll keep.
Now we need to output HTML fragment only.
Structure:
About the role
At Blue Origin, we envision millions of people living and working in space for the benefit of Earth. We’re working to develop reusable, safe, and low-cost space vehicles and systems within a culture of safety, collaboration, and inclusion. Join our team of problem solvers as we add new chapters to the history of spaceflight! This role is part of Enterprise Technology (ET), where we’re developing the digital infrastructure needed to build the road to space, with an emphasis on digital capabilities required to advance Blue Origin’s mission. Enterprise Technology is the center of excellence for digital technology at Blue Origin, providing oversight and governance to align technology and business strategies. The Blue Origin Cybersecurity GRC team is reducing the cost of security compliance through automation and engineering. This is primarily an engineering role: you will design, build, and operate the automation that makes compliance measurable, repeatable, and efficient, applying software and infrastructure engineering practices to the governance, risk, and compliance domains. It is well suited to software, SRE, platform, or DevOps engineers seeking to apply their automation expertise to security operations. Passion for our mission and vision is required!
Responsibilities
- Automating the collection of compliance artifacts and evidence across multiple cloud, SaaS, and internal platforms by integrating their APIs and normalizing the data.
- Building and operating CI/CD pipelines and Compliance-as-Code so compliance content is version-controlled, tested, and validated automatically.
- Automating configuration management and configuration monitoring - continuously validating system and platform configurations against approved baselines, detecting drift, and capturing results as evidence.
- Supporting continuous monitoring by integrating and correlating security telemetry and findings from partner-team platforms (including vulnerability management and SIEM/observability) into control-status reporting.
- Building GRC dashboards that integrate observability solutions to enable data-driven decisions.
- Developing outcome-driven metrics and KPIs to measure control effectiveness.
- Identifying manually intensive processes and engineering them away.
- Supporting risk assessments and maintaining policies aligned with security frameworks.
Requirements
- 7+ years building and operating production software or infrastructure automation (software, SRE, DevOps, platform, or security engineering).
- Proficiency in a general-purpose programming language (Python strongly preferred; Go, JavaScript/TypeScript, or similar welcome), with maintainable, tested, version-controlled code.
- Experience integrating disparate systems via REST APIs and automating data/evidence collection across multiple cloud and SaaS platforms.
- Hands-on experience with CI/CD pipelines (e.g., GitLab CI) and infrastructure-as-code (Terraform, Bicep, or similar).
- Experience with configuration management and configuration monitoring - config-as-code and continuous validation of system state against baselines, including drift detection.
- Ability to translate ambiguous, multi-stakeholder requirements into reliable automation.
- Aptitude and appetite to learn security compliance frameworks (NIST, ISO, CMMC); extensive prior GRC experience is not required.
- Bachelor's degree or certification in a technical field, or equivalent experience.
Qualifications
- Familiarity with GRC/compliance frameworks: NIST 800-53/800-171, ISO 27001, ISO 28000, SOC, CMMC, and privacy frameworks.
- Compliance-as-Code / OSCAL / policy-as-code (OPA/Rego, InSpec) experience.
- Configuration compliance and desired-state tooling (SCAP, CIS Benchmarks, Ansible, Salt, Chef/Puppet,
- for lists,
for prose. We need to decide what goes into each section. About the role: could contain the introductory paragraphs: "At Blue Origin, we envision millions of people living and working in space for the benefit of Earth...". Also description of Enterprise Technology and Cybersecurity GRC team and role description. We'll combine into a few paragraphs. Responsibilities: list each bullet from "Responsibilities Include But Are Not Limited To". We'll extract each line. Requirements: Minimum Qualifications list. Qualifications: Preferred Qualifications list. Benefits: list from Benefits paragraph. Pay: maybe a paragraph with base pay range. We must not include fluff like "commensurate with experience". Not present. We must not include duplicated lines. Let's extract content. Original text: "Application Close Date Applications will be accepted on an ongoing basis until the requisition is closed. At Blue Origin, we envision millions of people living and working in space for the benefit of Earth. We’re working to develop reusable, safe, and low-cost space vehicles and systems within a culture of safety, collaboration, and inclusion. Join our team of problem solvers as we add new chapters to the history of spaceflight! This role is part of Enterprise Technology (ET), where we’re developing the digital infrastructure needed to build the road to space, with an emphasis on digital capabilities required to advance Blue Origin’s mission. Enterprise Technology is the center of excellence for digital technology at Blue Origin, providing oversight and governance to align technology and business strategies. The Blue Origin Cybersecurity GRC team is reducing the cost of security compliance through automation and engineering. This is primarily an engineering role: you will design, build, and operate the automation that makes compliance measurable, repeatable, and efficient, applying software and infrastructure engineering practices to the governance, risk, and compliance domains. It is well suited to software, SRE, platform, or DevOps engineers seeking to apply their automation expertise to security operations. Passion for our mission and vision is required!" Then responsibilities list: "Responsibilities Include But Are Not Limited To Automating the collection of compliance artifacts and evidence across multiple cloud, SaaS, and internal platforms by integrating their APIs and normalizing the data. Building and operating CI/CD pipelines and Compliance-as-Code so compliance content is version-controlled, tested, and validated automatically. Automating configuration management and configuration monitoring - continuously validating system and platform configurations against approved baselines, detecting drift, and capturing results as evidence. Supporting continuous monitoring by integrating and correlating security telemetry and findings from partner-team platforms (including vulnerability management and SIEM/observability) into control-status reporting. Building GRC dashboards that integrate observability solutions to enable data-driven decisions. Developing outcome-driven metrics and KPIs to measure control effectiveness. Identifying manually intensive processes and engineering them away. Supporting risk assessments and maintaining policies aligned with security frameworks." Then Minimum Qualifications: "Minimum Qualifications 7+ years building and operating production software or infrastructure automation (software, SRE, DevOps, platform, or security engineering). Proficiency in a general-purpose programming language (Python strongly preferred; Go, JavaScript/TypeScript, or similar welcome), with maintainable, tested, version-controlled code. Experience integrating disparate systems via REST APIs and automating data/evidence collection across multiple cloud and SaaS platforms. Hands-on experience with CI/CD pipelines (e.g., GitLab CI) and infrastructure-as-code (Terraform, Bicep, or similar). Experience with configuration management and configuration monitoring - config-as-code and continuous validation of system state against baselines, including drift detection. Ability to translate ambiguous, multi-stakeholder requirements into reliable automation. Aptitude and appetite to learn security compliance frameworks (NIST, ISO, CMMC); extensive prior GRC experience is not required. Bachelor's degree or certification in a technical field, or equivalent experience." Preferred Qualifications: "Preferred Qualifications Familiarity with GRC/compliance frameworks: NIST 800-53/800-171, ISO 27001, ISO 28000, SOC, CMMC, and privacy frameworks. Compliance-as-Code / OSCAL / policy-as-code (OPA/Rego, InSpec) experience. Configuration compliance and desired-state tooling (SCAP, CIS Benchmarks, Ansible, Salt, Chef/Puppet, or PowerShell DSC). Continuous vulnerability monitoring - automating collection and correlation of findings from vulnerability management platforms (enterprise scanning is owned by a partner team). SIEM / observability integration. AI security experience. Aerospace, manufacturing, or OT/safety-critical environment experience." Pay: "Base Pay Range For WA applicants is $156,802.00 - $219,522.45 Other Site Ranges May Differ" Benefits: "Benefits Benefits include: Medical, dental, vision, basic and supplemental life insurance, paid parental leave, short and long-term disability, 401(k) with a company match of up to 5%, and an Education Support Program.Stock Options for all regular employees (working at least 20 hours/week)Paid Time Off: Up to four (4) weeks per year based on weekly scheduled hours, and up to 14 company-paid holidays.Dependent on role type and job level, employees may be eligible for benefits and bonuses based on the company's intent to reward individual contributions and enable them to share in the company's results, or other factors at the company's sole discretion. Bonus amounts and eligibility are not guaranteed and subject to change and cancellation. Please check with your recruiter for more details." We need to format Benefits as list maybe. The paragraph includes many items separated by commas and periods. We can split into list items: Medical, dental, vision, basic and supplemental life insurance, paid parental leave, short and long-term disability, 401(k) with a company match of up to 5%, Education Support Program, Stock Options for all regular employees (working at least 20 hours/week), Paid Time Off: Up to four (4) weeks per year based on weekly scheduled hours, and up to 14 company-paid holidays. Also note about bonuses etc maybe not needed as it's not a guaranteed benefit; but we can include as prose. We should not include the sentence about checking with recruiter maybe it's okay but it's not boilerplate? It's part of benefits description. We'll keep. Now we need to output HTML fragment only. Structure:
About the role
At Blue Origin, we envision millions of people living and working in space for the benefit of Earth. We’re working to develop reusable, safe, and low-cost space vehicles and systems within a culture of safety, collaboration, and inclusion. Join our team of problem solvers as we add new chapters to the history of spaceflight! This role is part of Enterprise Technology (ET), where we’re developing the digital infrastructure needed to build the road to space, with an emphasis on digital capabilities required to advance Blue Origin’s mission. Enterprise Technology is the center of excellence for digital technology at Blue Origin, providing oversight and governance to align technology and business strategies. The Blue Origin Cybersecurity GRC team is reducing the cost of security compliance through automation and engineering. This is primarily an engineering role: you will design, build, and operate the automation that makes compliance measurable, repeatable, and efficient, applying software and infrastructure engineering practices to the governance, risk, and compliance domains. It is well suited to software, SRE, platform, or DevOps engineers seeking to apply their automation expertise to security operations. Passion for our mission and vision is required!
Responsibilities
- Automating the collection of compliance artifacts and evidence across multiple cloud, SaaS, and internal platforms by integrating their APIs and normalizing the data.
- Building and operating CI/CD pipelines and Compliance-as-Code so compliance content is version-controlled, tested, and validated automatically.
- Automating configuration management and configuration monitoring - continuously validating system and platform configurations against approved baselines, detecting drift, and capturing results as evidence.
- Supporting continuous monitoring by integrating and correlating security telemetry and findings from partner-team platforms (including vulnerability management and SIEM/observability) into control-status reporting.
- Building GRC dashboards that integrate observability solutions to enable data-driven decisions.
- Developing outcome-driven metrics and KPIs to measure control effectiveness.
- Identifying manually intensive processes and engineering them away.
- Supporting risk assessments and maintaining policies aligned with security frameworks.
Requirements
- 7+ years building and operating production software or infrastructure automation (software, SRE, DevOps, platform, or security engineering).
- Proficiency in a general-purpose programming language (Python strongly preferred; Go, JavaScript/TypeScript, or similar welcome), with maintainable, tested, version-controlled code.
- Experience integrating disparate systems via REST APIs and automating data/evidence collection across multiple cloud and SaaS platforms.
- Hands-on experience with CI/CD pipelines (e.g., GitLab CI) and infrastructure-as-code (Terraform, Bicep, or similar).
- Experience with configuration management and configuration monitoring - config-as-code and continuous validation of system state against baselines, including drift detection.
- Ability to translate ambiguous, multi-stakeholder requirements into reliable automation.
- Aptitude and appetite to learn security compliance frameworks (NIST, ISO, CMMC); extensive prior GRC experience is not required.
- Bachelor's degree or certification in a technical field, or equivalent experience.
Qualifications
- Familiarity with GRC/compliance frameworks: NIST 800-53/800-171, ISO 27001, ISO 28000, SOC, CMMC, and privacy frameworks.
- Compliance-as-Code / OSCAL / policy-as-code (OPA/Rego, InSpec) experience.
- Configuration compliance and desired-state tooling (SCAP, CIS Benchmarks, Ansible, Salt, Chef/Puppet,