Staff Security Governance Engineer, Policies & Standards

Team: IT

Location: US

Commitment: Full-time

Workplace Type: remote

Accountabilities:

• Own the complete lifecycle of security policies, standards, procedures, and guidelines, including drafting, stakeholder review, approval, publication, periodic review, and retirement.
• Define and operate a risk-based exception management process covering approvals, expiration tracking, adherence trends, and recommendations for policy improvements.
• Manage policy attestation activities, investigate non-adherence, and develop measurable indicators of policy effectiveness and adoption.
• Monitor emerging regulations and security standards, including AI-focused requirements, and collaborate with Legal to assess their impact and update policies ahead of compliance deadlines.
• Maintain mappings between internal policies and frameworks such as SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF to enable requirements to be reused effectively.
• Conduct targeted internal assessments, coordinate remediation efforts, and support audits through evidence collection, testing, and remediation management.
• Support customer security questionnaires and meetings while identifying recurring customer needs that can be addressed through stronger policies and self-service resources.
• Identify and implement automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessment activities in partnership with GRC Engineering.
• Provide technical and program leadership across Security, Product, Legal, and Engineering, influencing stakeholders without direct authority while mentoring colleagues and helping shape the Security Governance roadmap.

Requirements

• 10+ years of experience in security governance, GRC, IT risk, or a related field, with hands-on ownership of policy and standards lifecycles and a track record of measurable outcomes.
• Strong working knowledge of security and compliance frameworks including SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, with the ability to apply them in practical operational environments.
• Understanding of cloud, SaaS, and DevSecOps practices, with the ability to create security policies that are clear, practical, and actionable for engineering teams.
• Strong risk-based approach, balancing regulatory and compliance requirements with real-world security risks and operational needs.
• Demonstrated experience using automation or AI to reduce manual governance, risk, and compliance activities.
• Excellent written and verbal communication skills, with the ability to translate technical and regulatory concepts for engineers, executives, auditors, customers, and other stakeholders.
• Proven ability to collaborate effectively across Security, Product, Legal, and Engineering teams and influence decisions without direct authority.
• Experience leading complex or ambiguous technical programs and mentoring other professionals through design, review, and implementation.
• Certifications such as CISSP, CISM, CISA, or similar credentials are highly desirable.

Benefits

• Base salary range of USD $168,000–$238,000 per year for eligible U.S.-based positions.
• Equity compensation and Employee Stock Purchase Plan.
• Benefits supporting health, finances, and overall well-being.
• Flexible Paid Time Off.
• Parental Leave.
• Growth and Development Fund to support ongoing learning and professional development.
• Team Member Resource Groups and an inclusive workplace culture.
• Fully remote work environment with an asynchronous, documentation-driven way of working.
• Opportunity to work on high-impact security governance initiatives spanning Security, Product, Legal, and Engineering.