GRC Engineer
Clerk · Remote
About the role
A senior, hands-on GRC engineer on Clerk's small security team, owning the compliance program that customers check before putting Clerk's authentication service in their own sign-in flow.
The engineer owns the SOC 2 Type II and HIPAA programs from scoping through audit and remediation, scopes the next framework (likely ISO 27001), writes integrations that feed the GRC platform, turns controls into continuous policy-as-code checks, runs vendor security reviews, owns questionnaires and the trust centre, and keeps the risk register. Clerk wants five or more years in security with experience automating a GRC program, having been the technical lead on a SOC 2 Type II or ISO 27001 audit, coding ability, use of a GRC platform's API, cloud IAM depth (GCP preferred), and strong writing. Remote.