Security Engineer, GRC

Treasure AI is an agentic experience platform built to acquire, retain, and grow valuable customers through AI-powered, continuous action. The Security Engineer, GRC will architect, build, and automate Trust & Assurance systems, including GRC platform integrations, AI-powered workflows, evidence collection, continuous control monitoring, risk modeling, and compliance tooling.

Responsibilities:

• Build AI agent workflows (using Claude, MCP integrations, or similar) to automate repeatable GRC tasks
• Configure and maintain the technical configuration and extension of our GRC platform — architect data relationships, configure control workflows, build custom rules, and extend the platform via APIs and webhooks rather than relying on the default UI
• Build automated executive readout workflows so monthly and quarterly GRC reporting is a 30-minute review, not a multi-day build
• Design and operate automated evidence collection pipelines and continuous control monitoring — pulling signals directly from source systems in real time so drift is surfaced before audit time, not during it
• Translate controls into testable, codified checks. Identify gaps in compliance coverage across CI/CD pipelines and IaC (Terraform) and contribute compliance logic where gaps exist
• Embed lightweight compliance checkpoints into design review workflows, ensuring control-relevant changes are flagged before deployment
• Support FAIR-informed quantitative risk modeling with data pipelines and tooling that make risk scenarios computable rather than narrative-only
• Build and maintain automation for the TPRM lifecycle — vendor intake, risk scoring, questionnaire distribution, evidence analysis, and remediation tracking — using AI-assisted tooling to reduce per-vendor manual effort
• Build tooling and dashboards that give the GRC Specialist and business stakeholders a continuous view of privileged access, access exceptions, and open remediation items — replacing point-intime UAR reports with an always-on IGA posture
• Build and maintain automation across the customer trust surface — AI-assisted questionnaire response pipelines, RFP contribution workflows, and trust center content management — so customer assurance accelerates deals rather than bottlenecking them
• Build automation across the security awareness and training lifecycle — detecting end-user risk signals or policy violations to improve the culture of security

Requirements:

• At least 3+ years in Security Engineering, DevSecOps, Technical GRC, or a closely adjacent function — with a demonstrably strong engineering track record in automation and tooling, not just program ownership
• Strong coding foundation: proficient in Python and/or TypeScript, comfortable calling REST APIs, handling JSON/YAML payloads, building webhooks, and shipping integrations from scratch without hand-holding or assistance. You treat Jira, Confluence, Slack, and similar enterprise tools as systems to integrate with, not just UIs to click through
• Hands-on experience building automation and integrations in enterprise environments — not just configuring OOTB features, but writing code to extend or connect systems
• Practical hands-on experience with a modern GRC platform (Vanta, anecdotes, Drata, Secureframe, or similar) — you've configured custom workflows, written rules, and used the APIs; not just the UI
• Working knowledge of SOC 2, ISO 27001/17/18, ISO 42001 and HIPAA — enough to read a control and determine how to test it programmatically
• Demonstrated experience shipping AI-assisted automation: agent workflows, prompt pipelines, LLM-integrated integrations, or similar. Comfort with agentic coding tools (Claude Code, Cursor, or equivalent)
• Familiarity with the AWS security control surface (IAM, CloudTrail, Config, GuardDuty) and how to consume compliance signals via API; working knowledge of CI/CD workflows (GitHub Actions or similar) and IaC (Terraform or equivalent) — you understand where compliance checks can be embedded in a deployment pipeline
• Strong collaboration and written communication skills — able to work across multiple Security domains, IT, Engineering, Legal/Privacy, and GTM, and able to write clear technical documentation