[Hiring] GRC Engineer @Coterie

Role Description

Coterie's GRC team is seeking a GRC Engineer to help build, test, and improve how we manage and validate security, technology, and compliance controls. This hands-on technical role focuses on continuous control monitoring, application and technology control testing, risk evaluation, and the collection and validation of audit evidence directly from source systems.

The ideal candidate combines a strong understanding of risk and controls with the technical ability to work directly with systems and data. You will build and perform control testing, identify control and process gaps, assess associated risk, and recommend practical remediation or compensating controls. You will also support broader GRC initiatives, including risk management, BC/DR, privacy, and other program priorities as needed.

Key Responsibilities

• Control Monitoring & Testing
  • Build and maintain repeatable testing and monitoring processes for security, technology, and application controls.
  • Define how controls will be tested, including testing procedures, evidence requirements, frequency, expected results, and exception criteria.
  • Perform control testing to assess design and operating effectiveness and document testing procedures, results, and conclusions.
  • Identify control failures, process gaps, control drift, and evidence deficiencies, and assess the related risk and compliance impact.
  • Investigate the cause of identified deficiencies and work with control owners to develop practical remediation or compensating controls.
  • Design and implement practical solutions to automate evidence collection, control testing, and continuous monitoring using queries, scripts, APIs, integrations, and GRC tooling where appropriate.
• Technical Evidence & Audit Support
  • Retrieve evidence directly from applications and source systems on behalf of control owners for audits, assessments, and control testing.
  • Build and document repeatable procedures for collecting and validating technical evidence, including system reports, configurations, access data, logs, vulnerability results, and change records.
  • Validate the completeness, accuracy, scope, and reliability of system-generated evidence and data used for testing and audits.
  • Support SOC 2, ITGC/SOX readiness, NYDFS, and other audit and compliance activities, including walkthroughs, evidence requests, testing, and auditor follow-up.
  • Maintain organized, audit-ready evidence and testing documentation and retest remediated controls as needed.
• Risk & Control Advisory
  • Assess the effectiveness of security and technology controls in mitigating their associated risks.
  • Translate regulatory, audit, and security requirements into practical control requirements and testing procedures.
  • Identify control and process gaps, assess the associated risk, and recommend control improvements, compensating controls, or other risk treatment options.
  • Support technical risk assessments, remediation planning, and other risk management activities.
• GRC Program Support
  • Support GRC initiatives across risk management, business continuity and disaster recovery, privacy, third-party risk management, governance, and regulatory compliance.
  • Identify and implement opportunities to use automation, AI, and other technologies to improve GRC processes while maintaining appropriate security, privacy, data handling, and human oversight.
  • Build and document processes, procedures, testing approaches, and supporting materials as GRC programs mature.
  • Partner with business and technical teams on assessments, remediation efforts, and other GRC priorities as assigned.

Qualifications

• 4+ years of relevant experience in IT audit, GRC, information security, security assurance, technology risk, or related disciplines.
• Hands-on experience testing technical security and technology controls and supporting audits or assessments such as SOC 2, SOX/ITGC, ISO 27001, NYDFS, NIST, or similar.
• Strong understanding of security control domains, including identity and access management, logging and monitoring, vulnerability and endpoint management, cloud security, change management, SDLC, and backup and recovery.
• Ability to independently retrieve, interpret, and validate technical evidence, including system configurations, access data, logs, vulnerability results, change records, and system-generated reports, including assessing completeness and accuracy.
• Working knowledge of SQL, KQL, PowerShell, or similar tools for querying, analyzing, and validating system data used in control testing. Software engineering experience is not required.
• Ability to evaluate control design and operation, understand the underlying risk, identify deficiencies and root causes, and recommend practical remediation or compensating controls.
• Strong analytical, communication, and professional judgment skills, with the ability to work independently and effectively with technical teams, auditors, control owners, and other stakeholders.

Preferred Qualifications (Bonus Experience)

• Experience with Azure, Entra ID, Microsoft 365, SIEM/SOAR, endpoint, vulnerability management, or other cloud and security tooling.
• Experience with continuous control monitoring, automated evidence collection, APIs, scripting, or integrations.
• Experience with GRC/IRM platforms such as Optro/AuditBoard, or similar.
• Experience in insurance, financial services, fintech, or another regulated industry, with familiarity with requirements such as NYDFS 23 NYCRR Part 500, NAIC, PCI DSS, or NIST CSF.
• CISA, CRISC, CISSP, CISM, Security+, or similar certification.

Benefits

• 100% remote
• Health insurance through Aetna (we pay 100% of premiums)
• Dental and vision insurance through Guardian (we pay 100% of premiums)
• Basic life insurance (we pay 100% of premiums)
• Access to flexible spending account (FSA) or health savings account (HSA) (for those using HSA eligible plans)
• 401K plan (up 4% match with immediate vest). Must be 21 years of age or older to participate
• Flexible PTO policy offering employees up to 4 weeks of PTO in their first 12 months. Thereafter, PTO usage aligns with company standards and typically does not exceed 5 weeks per calendar year.
• 12 company-paid holidays each year
• Continuing education annual stipend
• Annual salary estimated between $115,000-$140,000 based on national data.

Work Authorization

At this time, Coterie Insurance is unable to consider candidates who require current or future visa sponsorship. Applicants must have authorization to work in the United States without the need for sponsorship now or in the future. Falsification of an application, including work authorization status, is immediate grounds for dismissal from consideration.