GRC Engineer
You build the automation that keeps compliance true: controls as code, evidence from live systems, and continuous monitoring.
Competency areas
- Security Control Assessment
- Cybersecurity Supply Chain Risk Management
- DevSecOps
- Specialized practice
- Technology Program Auditing
- Data Analysis
- Systems Administration
- Systems Authorization
Job description templates
Three drafts to start from, for hiring managers and recruiters. Adapt one to your opening before you post it. Responsibilities and requirements come from the same NICE statements this role is measured against.
Statements use the official NICE Framework wording, which is published in English.
GRC Engineer: Junior
We are hiring a junior GRC Engineer. You build the automation that keeps compliance true: controls as code, evidence from live systems, and continuous monitoring. At this level you take on well-defined parts of the work, with senior colleagues to learn from, and grow into the rest.
[Company] provides [what you do]. The security function is [size and shape: e.g., a five-person team reporting to the CTO]. Replace this paragraph with your own.
Responsibilities
- Assess the effectiveness of security controls
- Develop risk, compliance, and assurance monitoring strategies
- Develop risk, compliance, and assurance measurement strategies
- Maintain baseline system security
- Update security documentation to reflect current application and system security design features
- Verify implementation of software, network, and system cybersecurity postures
- Document software, network, and system deviations from implemented security postures
- Recommend required actions to correct software, network, and system deviations from implemented security postures
- Pair with senior colleagues and grow through structured feedback.
- Document what you do so the team learns with you.
Required knowledge
- Risk Management Framework (RMF) requirements
- Risk management models and frameworks
- Configuration management (CM) tools and techniques
- Process improvement principles and practices
- Automated security control testing tools and techniques
- Data analysis tools and techniques
- Continuous monitoring principles and practices
- Continuous monitoring scoring and grading metrics
Skills
- Developing security assessments
- Analyzing processes to ensure conformance with procedural requirements
- Creating automated security control systems
- Maintaining automated security control systems
- Deploying continuous monitoring technologies
How to use this template
Copy the draft, replace every bracketed line, cut statements that do not apply to your opening, and add your compensation range and location policy. The statement lists come from the NIST NICE Framework v2.2.0, so candidates can be assessed against the same statements with Aramis:Insight.
GRC Engineer: Mid-level
We are hiring a mid-level GRC Engineer. You build the automation that keeps compliance true: controls as code, evidence from live systems, and continuous monitoring. You own this work day to day and work closely with the rest of the security team.
[Company] provides [what you do]. The security function is [size and shape: e.g., a five-person team reporting to the CTO]. Replace this paragraph with your own.
Responsibilities
- Assess the effectiveness of security controls
- Develop risk, compliance, and assurance monitoring strategies
- Develop risk, compliance, and assurance measurement strategies
- Maintain baseline system security
- Update security documentation to reflect current application and system security design features
- Verify implementation of software, network, and system cybersecurity postures
- Document software, network, and system deviations from implemented security postures
- Recommend required actions to correct software, network, and system deviations from implemented security postures
- Develop cybersecurity compliance processes for external services
- Determine if cybersecurity requirements have been successfully implemented
- Support cybersecurity compliance activities
- Determine effectiveness of configuration management processes
Required knowledge
- Risk Management Framework (RMF) requirements
- Risk management models and frameworks
- Configuration management (CM) tools and techniques
- Process improvement principles and practices
- Automated security control testing tools and techniques
- Data analysis tools and techniques
- Continuous monitoring principles and practices
- Continuous monitoring scoring and grading metrics
- Continuous monitoring tools and techniques
- Cybersecurity requirements
- Application programming interfaces (APIs)
- Role-based access control principles and practices
Skills
- Developing security assessments
- Analyzing processes to ensure conformance with procedural requirements
- Creating automated security control systems
- Maintaining automated security control systems
- Deploying continuous monitoring technologies
- Preparing reports
- Writing code in a currently supported programming language
- Collecting relevant data from a variety of sources
How to use this template
Copy the draft, replace every bracketed line, cut statements that do not apply to your opening, and add your compensation range and location policy. The statement lists come from the NIST NICE Framework v2.2.0, so candidates can be assessed against the same statements with Aramis:Insight.
GRC Engineer: Senior
We are hiring a senior GRC Engineer. You build the automation that keeps compliance true: controls as code, evidence from live systems, and continuous monitoring. You set the direction for this work, mentor the people who do it, and answer for its results.
[Company] provides [what you do]. The security function is [size and shape: e.g., a five-person team reporting to the CTO]. Replace this paragraph with your own.
Responsibilities
- Assess the effectiveness of security controls
- Develop risk, compliance, and assurance monitoring strategies
- Develop risk, compliance, and assurance measurement strategies
- Maintain baseline system security
- Update security documentation to reflect current application and system security design features
- Verify implementation of software, network, and system cybersecurity postures
- Document software, network, and system deviations from implemented security postures
- Recommend required actions to correct software, network, and system deviations from implemented security postures
- Develop cybersecurity compliance processes for external services
- Determine if cybersecurity requirements have been successfully implemented
- Support cybersecurity compliance activities
- Determine effectiveness of configuration management processes
- Define baseline system security requirements
- Monitor system and server configurations
- Assess third-party AI and model risk, including explainability, training-data provenance, and model documentation adequacy, before production use
- Cross-map controls between AI governance frameworks such as ISO/IEC 42001 and NIST AI RMF and assess certification readiness, eliminating duplicate evidence
- Mentor junior team members and review their work.
- Represent this function to leadership and to auditors or clients.
- Set standards, select tooling, and own the roadmap for this area.
Required knowledge
- Risk Management Framework (RMF) requirements
- Risk management models and frameworks
- Configuration management (CM) tools and techniques
- Process improvement principles and practices
- Automated security control testing tools and techniques
- Data analysis tools and techniques
- Continuous monitoring principles and practices
- Continuous monitoring scoring and grading metrics
- Continuous monitoring tools and techniques
- Cybersecurity requirements
- Application programming interfaces (APIs)
- Role-based access control principles and practices
- Cloud configuration management policies and procedures
- Continuous integration processes and procedures
Skills
- Developing security assessments
- Analyzing processes to ensure conformance with procedural requirements
- Creating automated security control systems
- Maintaining automated security control systems
- Deploying continuous monitoring technologies
- Preparing reports
- Writing code in a currently supported programming language
- Collecting relevant data from a variety of sources
- Auditing technical systems
- Performing data preprocessing
How to use this template
Copy the draft, replace every bracketed line, cut statements that do not apply to your opening, and add your compensation range and location policy. The statement lists come from the NIST NICE Framework v2.2.0, so candidates can be assessed against the same statements with Aramis:Insight.
Leading a team in this role? Turn these statements into a role definition with the Requisition Compiler, or see what Aramis:Build does for a team.
Related roles
Roles with similar work or at a similar career stage. Each has its own job description templates and a free assessment.