[Hiring] Security Engineer @Treasure AI

Role Description

Treasure AI is hiring a Security Engineer, GRC to architect, build, and automate the systems that power our Trust & Assurance (T&A) program.

The right person for this role gets frustrated by manual compliance work — not because it's beneath them, but because they know it doesn't have to exist.

This role sits at the intersection of security engineering and GRC. You will:

• Design, operate, and maintain the systems that make compliance continuous, visible in real-time, and GRC insights actionable.
• Treat the GRC platform as a programmable surface, extend it via APIs and agent workflows, and integrate it with the rest of Treasure AI's tech stack.
• Work closely with GRC Specialists to translate program requirements into technical implementations — automations, integrations, dashboards, guardrails, and tooling.
• Collaborate with Security, IT, Engineering, and Product teams to embed compliance into existing systems and pipelines.
• Utilize AI fluency to accelerate your work and build AI-powered automations into GRC workflows.

Responsibilities & Duties

• Build AI agent workflows (using Claude, MCP integrations, or similar) to automate repeatable GRC tasks.
• Configure and maintain the technical configuration and extension of our GRC platform — architect data relationships, configure control workflows, build custom rules, and extend the platform via APIs and webhooks.
• Build automated executive readout workflows for efficient GRC reporting.
• Design and operate automated evidence collection pipelines and continuous control monitoring.
• Translate controls into testable, codified checks and identify compliance coverage gaps across CI/CD pipelines and IaC (Terraform).
• Embed lightweight compliance checkpoints into design review workflows.
• Support FAIR-informed quantitative risk modeling with data pipelines and tooling.
• Build and maintain automation for the TPRM lifecycle using AI-assisted tooling.
• Build tooling and dashboards for continuous visibility of privileged access and remediation items.
• Build and maintain automation across the customer trust surface.
• Build automation across the security awareness and training lifecycle.

Qualifications

• At least 3+ years in Security Engineering, DevSecOps, Technical GRC, or a closely adjacent function.
• Strong coding foundation: proficient in Python and/or TypeScript, comfortable calling REST APIs, handling JSON/YAML payloads, building webhooks, and shipping integrations from scratch.
• Hands-on experience building automation and integrations in enterprise environments.
• Practical hands-on experience with a modern GRC platform (Vanta, anecdotes, Drata, Secureframe, or similar).
• Working knowledge of SOC 2, ISO 27001/17/18, ISO 42001 and HIPAA.
• Demonstrated experience shipping AI-assisted automation.
• Familiarity with the AWS security control surface and CI/CD workflows.
• Strong collaboration and written communication skills.

Travel Requirements

• Annual team on-site in the US/CAN (total travel: <10%)

Benefits

• Comprehensive medical, dental, vision plans and Employee Assistance Program (EAP).
• Competitive compensation packages.
• Company paid life insurance 3x salary.
• Company paid short- and long-term disability coverage.
• Retirement planning (401K) with 4% company match.
• Restricted Stock Units (RSU).
• Flexible Time Off (FTO).
• Up to 26 weeks paid parental leave including a post-partum night nurse.
• Comprehensive support and access to care for everyone, everywhere through Carrot - our global reproductive health and family-building benefit.

Our Dedication to You

We value and promote diversity, equity, inclusion, and belonging in all aspects of our business and at all levels. Success comes from acknowledging, welcoming, and incorporating diverse perspectives.

Diverse representation alone is not the desired outcome. We also strive to create an inclusive culture that encourages growth, ownership of your role, and achieving innovation in new and unique ways. Your voice will be heard, and we will help amplify it.

Agencies and Recruiters

We cannot consider your candidate(s) without a contract in place. Any resumes received without having an active agreement will be considered gratis referrals to us. Thank you for your understanding and cooperation!

This description captures the core of the role today. As we adopt AI and new ways of working, responsibilities may evolve, and we encourage team members to take initiative, lean into change, and help expand the impact of their role beyond what’s listed here.