Senior Information Security Engineer (GRC) - Remote

Overview

As an Information Security Engineer focused on Governance, Risk, and Compliance (GRC) at Clutch, you will own and mature our trust foundation. You will operationalize our security controls, drive evidence collection and continuous monitoring, and partner with product, engineering, and business teams to reduce risk while enabling speed.

In Short

• Own and mature the trust foundation for security controls.
• Drive evidence collection and continuous monitoring.
• Collaborate with product, engineering, and business teams.
• Baseline control library mapped to SOC 2, PCI DSS, and fintech obligations.
• Implement evidence collection pipelines for top controls.
• Lead SOC 2 Type II audit cycle end-to-end.
• Roll out vendor risk management workflow.
• Establish KPI/KRIs and dashboards for control effectiveness.
• Mature incident response playbooks.
• Work in a rapidly scaling fintech SaaS environment.

Requirements

• 5+ years in GRC, security engineering, or risk management.
• Experience with SOC 2 Type II and ISO 27001.
• Strong understanding of cloud security controls.
• Practical knowledge of secure SDLC and vulnerability management.
• Ability to translate requirements into actionable work.
• Excellent written communication skills.
• Nice to have: experience with privacy programs or relevant certifications.

Benefits

• Remote flexibility for work-life balance.
• Twice a year off-sites for team bonding.
• 20 PTO days and National Holidays.
• Stock options as part of the compensation.
• Budget for home office setup.
• Work trip budget for personal and professional growth.