[Remote] Senior Security Engineer - GRC

Note: The job is a remote job and is open to candidates in USA. Playlist is hiring a Senior GRC Engineer to build and maintain its multi-brand control architecture and manage the lifecycle of controls and evidence across compliance frameworks. The role also focuses on automating evidence collection, developing AI-powered GRC tooling, and translating compliance requirements into practical engineering guidance.

Responsibilities

• Design and build framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, using languages such as OSCAL as the translation layer to preserve framework-specific requirements while reducing duplicate audit burden
• Own the Master Control List end-to-end, including control nomenclature, relational database architecture, evidence linkages, and the operational model for ongoing maintenance across Playlist's multi-brand footprint
• Manage the full lifecycle of controls, evidence requirements, and implementation as new standards are adopted, requirements change, or acquired entities are brought into scope
• Drive evidence automation in GRC tooling, building collection workflows that scale without turning every audit season into a manual sprint
• Partner with Security Engineering, Legal, and Finance to validate that control design reflects how the business operates, translating compliance requirements into implementation guidance that engineering teams can act on
• Design, build and maintain AI-powered GRC tooling, multi-agent pipelines for risk quantification, evidence automation, vendor risk assessment, and compliance monitoring using cloud native tools and APIs, so the team's analytical and operational capacity scales without scaling headcount
• Identify rationalization opportunities across frameworks, so adding a new standard to the portfolio means incremental work, not starting from scratch

Skills

• 6+ years of experience in security engineering, GRC, or compliance engineering, with direct hands-on work across multiple regulatory frameworks
• Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53
• Experience designing or maintaining control frameworks, crosswalks, or unified control architectures across multiple compliance standards
• Hands-on experience managing evidence requirements and control implementation, not just documentation
• Proficiency with compliance automation tooling (Optro, Drata, Vanta, Hyperproof, Anecdotes, or similar)
• Ability to translate technical control design into clear implementation guidance for engineering and product teams
• Experience building or operating agentic AI workflows (LLM-based pipelines, multi-agent systems, RAG architectures) in a production or near-production context
• Hands-on experience with AWS services (Lambda, Step Functions, EventBridge, S3, Aurora/RDS) for building and maintaining compliance automation infrastructure
• Experience supporting external audits or assessments as a primary technical contact
• Exposure to multi-brand or post-acquisition control harmonization
• Certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP (HITRUST), or PCI ISA
• Experience in a SaaS or consumer marketplace environment

Benefits

• The total compensation package for this position may also include a performance bonus, benefits and/or other applicable incentive compensation plans

Company Overview

Company H1B Sponsorship