Posted May 25, 2026
We are looking for a Principal GRC Architect who can solve a unique challenge: How do we maintain "gold-standard" security certifications without killing our "ship-fast" culture? We are already under continuous observation for SOC 2 Type II and are GDPR compliant. We are now ready to evolve toward the most rigorous standards in the industry: TISAX, ITAR, and FedRAMP. This is a hands-on, individual contributor role. You will be the architect of the system and the person turning the gears, designing the roadmap and then personally implementing the controls. Your mission is to reconcile the rigidity of international standards with the agility of a fast-paced software company. You aren't here to create bureaucracy; you’re here to engineer compliance directly into our AWS infrastructure. ### Core Responsibilities
Maintain Continuous Observation: Uphold our SOC 2 Type II standard using automated monitoring to ensure compliance is a constant state, not an annual event. - Technical Infrastructure Strategy: Directly satisfy the high-bar technical requirements of . This includes managing the transition to/oversight of , defining network security boundaries, and ensuring encryption and IAM standards meet federal requirements. - Act as a technical enabler for the Engineering team, designing and implementing controls (e.g., change management, access reviews) that satisfy auditors but don’t bottleneck our Engineering or DevOps teams. - Architect and execute the technical and procedural implementation of . - Act as the internal authority on privacy, ensuring our data mapping and PIAs remain current without adding unnecessary friction. - Join calls with customer Infosec counterparts and handle technical vendor questionnaires to prove our security posture can be trusted by the world’s most demanding organizations. - Act as a "department of one". You will write the policies, perform the risk assessments, and manage the audits yourself. ###
Technical AWS Depth: You understand how to configure AWS beyond simple evidence collection. You are familiar with GovCloud, VPC isolation, network security, and IAM architecture. - Standard Mastery: Expert-level knowledge in at least two of: TISAX, ITAR, or FedRAMP. You have previously led a company through these audits or were responsible for maintaining their compliance. - Privacy & AI Knowledge: A deep, working knowledge of GDPR and an active interest in the evolving landscape of AI regulation. - The "Translator" Skillset: You can translate rigid regulatory requirements into actionable technical tasks that make sense to a developer. - Independence: You are energized by "getting your hands dirty" and owning the full lifecycle of a program without a team to delegate to. - Communication: Exceptional English skills; able to negotiate effectively with both internal engineers and external auditors.
Don't want to apply yourself?
Our team writes your resume, applies for you, preps you for interviews, and negotiates your offer.
Browse Jobs
By Role
By City