Senior GRC Engineer, Anaplan

• 6+ years in security engineering, GRC, DevSecOps, or a closely related technical role, with hands-on exposure to compliance/regulatory frameworks
• Comfortable writing scripts or light code (Python, Bash, or similar) to automate evidence collection, reporting, or monitoring tasks
• Working knowledge of at least two of: ISO 27001 and its extensions (27017, 27018, 27701, 42001), SOC 1/2, Cyber Essentials, or similar, including experience using a cross-framework control mapping/crosswalk to reduce duplicate implementation effort
• Comfortable building and reading system/data-flow diagrams, and proficient with a GRC/risk platform (e.g., Drata, Vanta, Hyperproof, Archer, OneTrust, ServiceNow GRC, or similar)
• Experience translating compliance/risk requirements into implementation guidance engineering teams can act on
• Comfort engaging directly with both engineering teams and customers on technical topics, and building process/tooling in a growing function

Desirable

• As an Engineer III, Security and Compliance, you're the technical bridge between GRC and the rest of the business
• You're comfortable sitting in a room with engineering and talking architecture some days, and on other days, feeling confident on a customer call and translating security into practice to build trust
• Your north star is compliance by design: instead of audits being a point-in-time scramble to assemble evidence, they should be a natural byproduct of controls, monitoring, and processes that run continuously, year-round
• A core part of that is thinking in terms of build once, apply to many: using our cross-framework control crosswalk to identify where requirements across our certified standards — including ISO 27001, 27017, 27018, 27701, and 42001, SOC 1/2 Type 2, Cyber Essentials, ENS, and TX-RAMP — genuinely overlap, so our partners build to a single common control instead of a different bespoke solution for every certification
• As important as the automation itself is, it's also about making the reasoning behind it visible: helping partners across the business understand the why behind a given control, whether it traces back to a compliance obligation, a customer request, or an emerging threat, not just the what
• Over time, you'll develop genuine fluency in how the Anaplan product and platform work, how we manage our infrastructure and internal systems, and where our security controls live operationally
• Act as a technical GRC partner to technical and non-technical teams, translating compliance, governance, and risk requirements into implementation details, and engaging credibly in architecture/design discussions
• Use the cross-framework control crosswalk to identify synergies across regulatory requirements, so engineers build one common solution instead of duplicating effort per certification
• Support customer-facing security/compliance conversations requiring deeper technical context (platform architecture, control implementation, how obligations are met)
• Build the processes, scripts, workflows, and tooling that embed controls into daily operations, and design automation that keeps compliance/risk data current continuously rather than refreshed only ahead of audits
• Create knowledge-sharing resources and clear documentation/diagrams that help partners understand the reasoning behind a control — whether it's a compliance obligation, a customer request, or an emerging threat — not just the mechanics of it
• Partner with Risk Management to engineer risk identification, scoring, and monitoring into day-to-day operations; support continuous monitoring (ConMon) across Compliance, Risk, and Governance; and build working knowledge of the Anaplan product/platform over time