[Hiring] Commercial GRC Engineer @Smartsheet

Role Description

Smartsheet is looking for a Sr. Security Engineer I to bring an engineering mindset to our commercial GRC program. This role involves:

• Owning control automation for SOC 2, ISO 27001/27017/27701, HIPAA, and related commercial frameworks.
• Designing and building automated evidence collection and continuous control monitoring across cloud, identity, endpoint, and SaaS systems.
• Expressing controls, control tests, and cross-framework mappings as version-controlled code.
• Translating compliance requirements into technical control logic, workflows, and integrations.
• Participating in architecture and design reviews to define control requirements as acceptance criteria.
• Designing the engineer-facing experience of compliance with self-service control status and compliance feedback.
• Evaluating whether controls actually reduce relevant risk and proposing alternative controls when necessary.
• Supporting full audit cycles end-to-end, including coordinating evidence requests and tracking remediation items.
• Building and maintaining dashboards and reporting for GRC and security leadership.
• Identifying and eliminating duplicate evidence-gathering efforts across overlapping frameworks.
• Diagnosing root causes of recurring control failures and fixing underlying issues.
• Partnering with the GRC Team Lead and SATellite engineering to extend our internal GRC platform's capabilities.

Qualifications

• 4+ years of experience in GRC engineering, security engineering, compliance automation, or IT audit support.
• Hands-on ownership of at least one full certification cycle (SOC 2, ISO 27001, or similar).
• Practical experience with GRC or compliance automation platforms (e.g., Vanta, Drata, Secureframe).
• Experience with cloud security fundamentals (AWS/GCP/Azure IAM, logging, encryption).
• Solid working knowledge of SOC 2, ISO 27001, and HIPAA control requirements.
• Comfort with scripting or light development (Python, JavaScript, or similar).
• Strong written communication skills.
• A stakeholder-centric mindset.
• Demonstrated ability to trace a control failure or audit finding back to its root cause.
• Legally eligible to work in the U.S. on an ongoing basis.

Benefits

• Employer subsidized medical/vision and dental coverage for full-time employees.
• 401k Match to help you save for your future (50% of your contribution up to the first 6% of your eligible pay).
• Monthly stipend to support your work and productivity.
• Flexible Time Away Program, plus Sick Time Off.
• Automatic coverage under Smartsheet-sponsored life insurance, short-term, and long-term disability plans.
• 12 paid holidays per year.
• Up to 24 weeks of Parental Leave.
• Personal paid Volunteer Day to support our community.
• Opportunities for professional growth and development including access to Udemy online courses.
• Company Funded Perks, including a counseling membership and local retail discounts.
• Teleworking options from any registered location in the U.S. (role specific).
• Competitive base salary range for roles that may be hired in different geographic areas.