[Hiring] GRC Engineer @Gainsight

Role Description

We’re looking for a full-time GRC Engineer to join our Security team reporting to the Director of Security. This role is a remote role based in Mexico.

In this role, you'll play a key role in maintaining Gainsight's governance, risk, and compliance program and keeping the company audit-ready by:

• Maintaining control frameworks
• Supporting internal and external audits
• Assessing third-party risk
• Automating evidence collection

This is a great opportunity for someone who thrives in a detail-oriented, SaaS and cloud-based environment and enjoys working cross-functionally with teams like Security, Engineering, IT, and Legal. The ideal candidate brings strong skills in GRC frameworks (SOC 2, ISO 27001, NIST), audit and risk management, and clear communication.

What You'll Do

• Maintain multiple control frameworks and map controls to standards
• Track control ownership and health
• Meet with control owners to address gaps in controls
• Scope audits for both internal and external audits
• Work with auditors through the audit process from kick-off to completion
• Collect and review evidence for all frameworks to ensure compliance and traceability
• Track audit findings and remediations to completion
• Perform security reviews of all Third-Parties and Vendors
• Track vendor remediation items and maintain the vendor inventory
• Draft, update, and maintain all security policies, procedures, and standards regularly
• Answer customer security questionnaires and requests
• Support customer audits and provide compliance documentation where required
• Manage the risk register including exceptions, acceptance, expiry
• Build and maintain integrations and automation for evidence collection and control monitoring
• Work with engineering teams to align technical controls to business requirements

This role may require occasional travel (up to 10-25%) for team meetings, training, or company events. This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business.

Qualifications

• 5+ years of experience in GRC, security compliance, IT audit, or risk management, ideally within a SaaS or cloud-based company.
• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, and NIST, including how to map controls across them.
• Experience supporting external audits and assessments, including scoping, evidence collection, walkthroughs, and tracking findings through remediation.
• Experience performing risk assessments, maintaining a risk register, and reviewing the security posture of third-party vendors.
• Familiarity with compliance automation or GRC tools, and experience implementing security automation, such as scripting or workflow tools that automate recurring evidence collection and control monitoring.
• Understanding of cloud infrastructure and common security controls (access management, logging, encryption, change management) sufficient to evaluate evidence and discuss it with engineers.
• Clear written and verbal communication, with the ability to explain control requirements and risk to technical and non-technical teams and to manage several deadlines at once.

Nice-to-have skills or experience

• Experience with AI Governance frameworks.
• Previous experience with highly regulated industries that require HIPAA or FedRamp.
• Experience working with globally distributed teams.
• Security certifications such as CISA, CRISC, or Security+ certifications.

Benefits

• Innovation shaped through collaboration, curiosity, and a shared focus on solving real-world problems.
• Growth opportunities from mentoring to career development.
• A supportive culture that offers stability, trust, and connection.