Description
We believe that the way people interact with their finances will drastically improve in the next few years. We're dedicated to empowering this transformation by building the tools and experiences that thousands of developers use to create their own products.
The Security Governance, Risk, and Compliance (GRC) team is part of Plaid's security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls. Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners.
The Role: You will own GRC Engineering at Plaid , a foundational, high-ownership role defining an emerging discipline from the ground up. Today most of our compliance work is manual and point-in-time; you will turn it into an engineered system that is continuous, data-driven, and scalable, and set the technical direction for the field.
Responsibilities:
- Architect GRC's Engineering Foundation: Build the pipelines and codified source of truth the function runs on , controls, policies, and framework mappings captured as structured, version-controlled data and fed by live control and system state.
- Build Continuous Controls Monitoring: Automate evidence collection, control testing, and monitoring across cloud and internal systems.
- Turn Data into Risk Signal: Build dashboards and SQL-driven reporting that turn raw control and risk data into KPIs, giving the team and leadership real-time visibility into risk posture.
- Drive Data-Informed Risk Assessments: Conduct security and technology risk assessments and recommend mitigations using data.
- Automate Operational Toil: Eliminate the recurring manual work the team carries , evidence pulls, access and vendor reviews, questionnaires, risk-register upkeep, status reporting , with durable automation that gives time back across every workstream.
- Shift Compliance Left with Code and AI: Embed compliance checks into the CI/CD flow as policy-as-code so controls are validated as code ships.
Qualifications:
- Software & Data Engineering Foundations:
- Strong Python and SQL, with a proven track record of building API/webhook integrations that connect disparate systems.
- Experience owning an internal tool or service end to end , design, build, operate, and maintain , with real users depending on it.
- Applied GRC Engineering:
- Experience building and operating continuous controls monitoring end to end.
- Demonstrated ability to model controls, policies, and framework mappings as structured, version-controlled data rather than docs and spreadsheets.
- Compliance & risk knowledge:
- Working knowledge of SOC 2, ISO 27001/27701, and NIST CSF/800-53.
- AI fluency & tooling:
- Demonstrated ability to build and scale agentic / AI-assisted workflows.
Benefits:
- Comprehensive benefit plan, including medical, dental, vision, and 401(k).
- Additional compensation in the form(s) of equity and/or commission are dependent on the position offered.