Security Governance Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Governance Engineer, Policies & Standards based in United States.

This role offers the opportunity to shape how security policies and standards are created, maintained, communicated, and measured across a global technology environment.

• Own the complete lifecycle of security policies, standards, procedures, and guidelines, including drafting, stakeholder review, approval, publication, periodic review, and retirement.
• Define and operate a risk-based exception management process covering approvals, expiration tracking, adherence trends, and recommendations for policy improvements.
• Manage policy attestation activities, investigate non-adherence, and develop measurable indicators of policy effectiveness and adoption.
• Monitor emerging regulations and security standards, including AI-focused requirements, and collaborate with Legal to assess their impact.
• Maintain mappings between internal policies and frameworks such as SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.
• Conduct targeted internal assessments, coordinate remediation efforts, and support audits through evidence collection, testing, and remediation management.
• Support customer security questionnaires and meetings.
• Identify and implement automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessment activities.

• 10+ years of experience in security governance, GRC, IT risk, or a related field.
• Strong working knowledge of security and compliance frameworks including SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.
• Understanding of cloud, SaaS, and DevSecOps practices.
• Strong risk-based approach.
• Demonstrated experience using automation or AI to reduce manual governance, risk, and compliance activities.
• Excellent written and verbal communication skills.
• Proven ability to collaborate effectively across Security, Product, Legal, and Engineering teams.
• Experience leading complex or ambiguous technical programs.
• Certifications such as CISSP, CISM, CISA, or similar credentials are highly desirable.

• Base salary range of USD $168,000–$238,000 per year for eligible U.S.-based positions.
• Equity compensation and Employee Stock Purchase Plan.
• Benefits supporting health, finances, and overall well-being.
• Flexible Paid Time Off.
• Parental Leave.
• Growth and Development Fund.
• Team Member Resource Groups and an inclusive workplace culture.
• Fully remote work environment with an asynchronous, documentation-driven way of working.