GRC Engineer

About this role

ButterflyMX seeks a GRC Engineer to build and operate a modern governance, risk, and compliance program centered on automation and AI-driven workflows. This individual contributor role reports to the CISO and spans the full GRC landscape—from audit management and risk registers to vendor assessment and privacy operations—with an emphasis on replacing manual processes with scalable, continuous monitoring systems.

What you'll do

• Own and mature the company risk register using AI tooling to surface, score, and route emerging risks in real-time
• Lead external audit management (SOC 2 Type II) and automate evidence collection in Vanta for continuous compliance readiness
• Engineer trust and assurance program with automated intake, AI-assisted questionnaire responses, and self-service partner due diligence
• Build vendor and supply chain risk program with automated intake, tiered scoring, and continuous monitoring triggers
• Redesign security and privacy policies using AI drafting and lightweight approval workflows
• Configure common controls monitoring in Vanta with automated alerts routed to control owners

What they're looking for

• GRC platforms and tools (Vanta expertise preferred)
• Compliance frameworks (SOC 2 Type II, ISO 42001, privacy regulations)
• Automation and workflow design
• AI and prompt engineering for compliance tasks
• Risk management and vendor assessment
• Security and privacy policy development
• Supply chain and third-party risk analysis
• Audit management and evidence collection

Benefits

• Remote work flexibility (US-based)
• Direct reporting to CISO with high visibility
• Opportunity to shape a modern, AI-forward compliance function
• Exposure to full GRC landscape across a growing scale-up

Likely interview questions

• How would you design an automated risk register that surfaces and scores emerging risks with minimal manual intervention?
• Describe your experience with Vanta or similar GRC platforms—what automations have you built or configured?