Compliance Automation Engineer, GRC

At Vanta, our mission is to secure the internet and protect consumer data. We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it. Vanta is growing quickly and we're continually moving upmarket, dealing with sophisticated customers with complex security and compliance environments and needs. Our Security team uses our own Security and Privacy GRC experience to meet customer demand to help grow our market share as the industry leader in compliance and security.As a Compliance Automation Engineer, GRC at Vanta, you will support FedRAMP Authorization efforts on the Vanta Security Team, working closely with cross-functional Engineering and Product teams. Your focus will be managing critical authorization audit readiness and continuous monitoring process, automating evidence collection wherever possible.If this sounds like you, and you're excited to use your Security and GRC experience to help grow and sell our product, we'd love to hear from you.Visit our Vanta Engineering Blog to learn more about what our team is working on! What you’ll do as a Compliance Automation Engineer, GRC at Vanta:Design and develop automation solutions for evidence collection across infrastructure, endpoints, and SaaS platforms (e.g., AWS, GCP, GitHub, Okta).Build and maintain scripts and APIs to interface with compliance toolingSupport recurring internal and external audits (FedRAMP, SOC 2, ISO 27001, HIPAA, etc.) by ensuring automated and reliable control monitoringAutomate control testing and reporting pipelines to reduce manual effort and improve accuracySupport internal GRC platforms, dashboards, and metrics to communicate compliance posture and audit findingsWork with the compliance team to define technical control requirements and translate them into measurable, testable systemsWork with Engineering partners to embed compliance checks into CI/CD pipelines and infrastructure deployment workflowsEstablish and manage the POAM and Continuous Monitoring processes and run monthly PMO meetingsManage compliance deliverables for public sector stakeholders and manage ongoing updatesLeverage AI/ML tools to drive automation and improve efficiency and outcomes for audit and monitoring processesDrive remediation for Security Team gaps and dependencies - this includes investigating and POCing solutions to replace existing tech where neededDrive remediation of FedRMAP authorization gapsSupport policy and process implementation for business and engineering processes to support authorizationSupport the implementation of technical controls within the security and engineering teamsContribute to the development of machine readable reports for Product TeamGather performance metrics and report KPIs to security team leadersBecome an expert on the Vanta public sector product offerings and provide regular feedback to product teamsSupport the team responding to public sector security questionnairesPartner to help improve existing and launch new security and compliance processes, programs, and policies where neededSupport audit readiness across Vanta’s compliance frameworks as neededHow to be successful in this role:3+ years of experience in scripting, automation, or backend engineering roles with a focus on security, infrastructure, or complianceExpertise with public sector security frameworks like FedRAMP and CMMCExperience with other NIST frameworks like NIST CSF, 800-53, 800-171, RMFAbility to write scripts and basic code to automate audit and evidence gathering processesProficiency in at least one or more common scripting languages like Python, Go, PowerShell, Bash, Ruby, or JavaScript,Experience consuming and building RESTful APIs to integrate various security, IT, and GRC toolsExperience querying APIs, building command-line tools, and working with structured data (JSON, CSV, YAML, OSCAL)Ability to query and manipulate data in various datastores to extract compliance-relevant informationFamiliarity with Cloud Infrastructure, Version Control Systems, Risk Management, Vulnerabilities, and their related security processesExperience in product and program managementExperience in building productive relationships and driving collaboration with both technical and non-technical teamsKnowledge of audit processes and evidence requirements for cybersecurity frameworksSecurity compliance management experience within a SaaS environment preferred, but not requiredExperience working with other security frameworks like SOC2 and ISO27001 preferred but not requiredSecurity certifications (e.g. CISA, CISSP, CRISC) and/or formal education strongly preferred, but not requiredWhat you can expect as a Vantan:Industry-competitive compensation100% covered medical, dental, and vision benefits with dependents coverage16 weeks fully-paid parental Leave for all new parentsHealth & wellness and remote workplace stipendsFamily planning benefits through Carrot Fertility401(k) matchingFlexible work hours and locationOpen PTO policy11 paid holidays in the USOffices in SF, NYC, London, Dublin, and SydneyTo provide greater transparency to candidates, we share base pay ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar-stage growth companies. Final offer amounts are determined by multiple factors and may vary based on candidate location, skills, depth of work experience, and relevant licenses/credentials. #LI-remoteAt Vanta, we are committed to hiring diverse talent of different backgrounds and as such, it is important to us to provide an inclusive work environment for all. We do not discriminate on the basis of race, gender identity, age, religion, sexual orientation, veteran or disability status, or any other protected class. As an equal opportunity employer, we encourage and welcome people of all backgrounds to apply.About VantaWe started in 2018, in the wake of several high-profile data breaches. Online security was only becoming more important, but we knew firsthand how hard it could be for fast-growing companies to invest the time and manpower it takes to build a solid security foundation. Vanta was inspired by a vision to restore trust in internet businesses by enabling companies to improve and prove their security.From our early days automating security monitoring for compliance standards like SOC 2, HIPAA and ISO 27001 to creating the world's leading Trust Management Platform, our vision remains unchanged. Now more than ever, making security continuous—not just a point-in-time check— is essential. Thousands of companies rely on Vanta to build, maintain and demonstrate their trust— all in a way that's real-time and transparent.

Apply Now