The GRC Engineer will handle risk assessments, automate GRC processes, maintain policies, and support compliance frameworks while collaborating with security teams.
About Us
TherapyNotes is the go-to superhero for behavioral health Practice Management and EHR software! Our top-notch SaaS solution handles scheduling, billing, documenting, telehealth, and more so clinicians can focus on awesome patient care.
We're a dynamic team of pros who love to innovate and push the envelope, keeping our software cutting-edge. Join us, and let's revolutionize behavioral health software together while making a real difference!
About The Position
TherapyNotes is seeking a GRC Engineer who combines strong foundational GRC expertise with the ability to design and implement scalable, automated solutions. This role is responsible for both executing core GRC functions (e.g., risk assessments, policy management, third-party risk) and transforming those processes through engineering and automation.
The ideal candidate understands how GRC work is performed today—and has the technical skills to improve, scale, and modernize it.
What You'll Do
Core GRC Operations (Hands-On Execution)
- Conduct third-party risk assessments (TPRM), including vendor reviews, security questionnaires, and risk evaluations
- Maintain and update security policies, standards, and procedures
- Support compliance initiatives across frameworks (SOC 2, ISO 27001, HIPAA, NIST, etc.)
- Perform internal risk assessments, control testing, and gap analyses
GRC Engineering & Automation
- Identify manual, repetitive GRC processes and design automated solutions
- Build and maintain automated evidence collection (via APIs, scripts, and integrations)
- Implement continuous control monitoring (CCM) to replace point-in-time audits
- Translate compliance requirements into technical controls and system configurations
- Validate control effectiveness through automated testing and monitoring
- Enable real-time or near-real-time risk visibility through dashboards and reporting systems
- Work with Security Engineering to continuously audit configurations and remediate drift programmatically
- Build scalable workflows for vendor risk assessments, re-assessments and tracking
- Integrate vendor data into centralized risk systems
- Automate intake, review, and monitoring processes for third-party security posture
- Develop self-service audit evidence systems and dashboards
- Partner with auditors to provide API-driven or system-generated evidence
What We're Looking For
- Bachelor’s degree in Computer Science, Engineering, or related field (or equivalent experience)
- 3–6+ years in security engineering, GRC, GRC engineering, or cloud security roles
- Strong experience with scripting/programming (Python, Go, or similar)
- Hands-on experience with cloud platforms (AWS, Azure, or GCP)
- Familiarity with Infrastructure as Code (Terraform, CloudFormation, etc.)
- Deep understanding of security controls and how they map to compliance frameworks
- Experience integrating APIs and building automation pipelines
Bonus Points
- Experience with policy-as-code tools
- Experience with GRC automation platforms
- Familiarity with SIEM, SOAR, and security telemetry systems
- Experience building internal tools or platforms for compliance and risk management
- Certifications such as CISSP, CISM, CRISC, or cloud security certifications
What We Offer
- Competitive salary - $100,000-$140,000
- Employer sponsored health, dental, vision, life, and disability insurance
- Retirement plan with company contribution
- Annual company profit sharing
- Personal development/training budget
- Open, collaborative work environment
- Extensive 2-week onboarding plan
- Comprehensive mentorship program
Top Skills
AWS
Azure
CloudFormation
GCP
Go
Python
Terraform
Similar Jobs
Software
The GRC Engineer will lead WorkOS's Governance, Risk, and Compliance program, ensuring compliance frameworks are applied and automated. Responsibilities include managing compliance, risk, and customer audits, and collaborating with various teams to build durable systems for compliance processes.
Top Skills:
DrataGoPythonTypescriptVanta
Artificial Intelligence • Information Technology • Software
The GRC Engineer will guide clients through federal compliance frameworks, manage multiple compliance initiatives, and support FedRAMP and CMMC compliance efforts.
Top Skills:
Aws GovcloudAzure GovernmentCmmcFedrampGcc HighNist Sp 800-171Nist Sp 800-53Poa&MsSsps
Artificial Intelligence • Information Technology • Software
As a GRC Engineer I, support cybersecurity compliance initiatives, maintain documentation, assist in risk mitigation, coordinate project tasks, and communicate with clients.
Top Skills:
FedrampGdprIso 27001Nist 800-171Nist 800-53Soc 2
What you need to know about the San Francisco Tech Scene
San Francisco and the surrounding Bay Area attracts more startup funding than any other region in the world. Home to Stanford University and UC Berkeley, leading VC firms and several of the world’s most valuable companies, the Bay Area is the place to go for anyone looking to make it big in the tech industry. That said, San Francisco has a lot to offer beyond technology thanks to a thriving art and music scene, excellent food and a short drive to several of the country’s most beautiful recreational areas.
Key Facts About San Francisco Tech
- Number of Tech Workers: 365,500; 13.9% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Google, Apple, Salesforce, Meta
- Key Industries: Artificial intelligence, cloud computing, fintech, consumer technology, software
- Funding Landscape: $50.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Sequoia Capital, Andreessen Horowitz, Bessemer Venture Partners, Greylock Partners, Khosla Ventures, Kleiner Perkins
- Research Centers and Universities: Stanford University; University of California, Berkeley; University of San Francisco; Santa Clara University; Ames Research Center; Center for AI Safety; California Institute for Regenerative Medicine
