Security Engineer (GRC)

• The Security Governance, Risk, and Compliance (GRC) team is part of Plaid’s security organization, focused on enabling the business by proactively managing information security risks and maintaining effective controls
• Our mission is to reduce the likelihood and impact of security risks while operating a robust assurance program that builds trust with our customers, consumers, and data partners
• We own Plaid’s security compliance frameworks, run our audits and risk programs, and partner across the company to keep Plaid’s platform secure, resilient, and aligned with industry and regulatory expectations
• GRC Engineering is how we make all of that scale — turning compliance into code, evidence into telemetry, and audits into a continuous, automated capability
• You will own GRC Engineering at Plaid — a foundational, high-ownership role defining an emerging discipline from the ground up. Today most of our compliance work is manual and point-in-time; you will turn it into an engineered system that is continuous, data-driven, and scalable, and set the technical direction for the field
• Define the discipline and the architecture — how GRC Engineering works at Plaid, not just execute within it
• Build the foundation the function runs on — a codified source of truth for controls, policies, and evidence, fed by live pipelines and continuous controls monitoring
• Be the engineering backbone for Security Assurance & Trust Enablement, Third-Party Ecosystem Risk, and Risk Management
• Make risk visible and data-driven — turning control and risk data into real-time signals for the team and leadership
• Pioneer where compliance is heading — compliance-agents-as-code in the SDLC, AI- and agent-driven workflows, and machine-readable continuous compliance (FedRAMP 20x)
• Architect GRC’s Engineering Foundation: Build the pipelines and codified source of truth the function runs on — controls, policies, and framework mappings captured as structured, version-controlled data and fed by live control and system state — so one control maps evidence across SOC 2, ISO, NIST, and beyond instead of being re-collected for every audit
• Build Continuous Controls Monitoring: Automate evidence collection, control testing, and monitoring across cloud and internal systems, and write and tune the detection that flags drift and misconfiguration against baseline — so audit readiness is continuous and gaps surface the moment they appear, not at audit time
• Turn Data into Risk Signal: Build dashboards and SQL-driven reporting that turn raw control and risk data into KPIs, giving the team and leadership real-time visibility into risk posture
• Drive Data-Informed Risk Assessments: Conduct security and technology risk assessments and recommend mitigations using data — keeping the risk management program running while cutting its manual overhead
• Automate Operational Toil: Eliminate the recurring manual work the team carries — evidence pulls, access and vendor reviews, questionnaires, risk-register upkeep, status reporting — with durable automation that gives time back across every workstream
• Shift Compliance Left with Code and AI: Embed compliance checks into the CI/CD flow as policy-as-code so controls are validated as code ships, prototype self-healing policies reconciled against live infrastructure, and scale agentic / AI-assisted workflows across the function
• Future-proof for Continuous Compliance: Build toward machine-readable, continuously validated evidence (FedRAMP 20x-style Key Security Indicators), positioning Plaid to meet continuous-compliance expectations as we enter new markets and pursue new authorizations

Benefits

• Vibrant offices in SF, NYC, and Raleigh-Durham—with catered meals, happy hours, and clubs to keep you connected
• Competitive pay, comprehensive health benefits, and support for fertility, mental health, and parental leave
• Lifestyle perks including home office stipends, daycare support, and commuting benefits like CitiBike and Lyft
• You treat every roadblock as just an obstacle to route around — you don’t back down, because there’s always a path
• You’re relentlessly curious — you poke, you investigate, and you dig into how controls can silently fail, drift, or get bypassed so you can catch it automatically
• You like range — juggling several problems across security, risk, compliance, and engineering beats grinding on a single one
• You love building and shipping internal tools and solutions that people actually use
• You think in systems: you’d rather design the thing that eliminates a whole class of manual work than automate one task at a time
• You’re energized by turning compliance from a documentation exercise into demonstrable, continuous, machine-readable evidence
• Proficiency with dashboarding / data-visualization tools (e.g., Mode) to turn control and risk data into KPIs and signal
• Experience owning an internal tool or service end to end — design, build, operate, and maintain — with real users depending on it
• Hands-on experience with AWS and cloud-native security controls, including the ability to query cloud, GitHub, and SaaS logs
• Strong Python and SQL, with a proven track record of building API/webhook integrations that connect disparate systems
• Hands-on experience with IaC (Terraform) and policy-as-code (OPA/Rego, Sentinel), including embedding compliance checks into CI/CD
• Proven ability to eliminate recurring operational toil — evidence pulls, access and vendor reviews, questionnaires, risk-register upkeep, status reports — with durable automation rather than one-off scripts
• Experience conducting security or technology risk assessments and translating findings into data-driven mitigation
• Experience with audit / compliance automation platforms (Anecdotes, Drata, Vanta, Paramify, or similar)
• Ability to work independently and cross-functionally across security, infrastructure, and engineering, with strong prioritization and the ability to influence without authority
• Demonstrated ability to build and scale agentic / AI-assisted workflows (Claude, OpenAI) as leverage for the whole team
• Degree in Computer Science, Cybersecurity, or a related field
• Exposure to security incident response and triage
• Experience in a high-growth fintech or financial-services environment
• Experience building and operating continuous controls monitoring end to end — collecting signal from live systems, writing and tuning the detection logic that compares state to a baseline, alerting, and driving remediation
• Familiarity with the shift to continuous compliance (FedRAMP 20x, machine-readable Key Security Indicators) and how it changes evidence and control design
• Demonstrated ability to model controls, policies, and framework mappings as structured, version-controlled data rather than docs and spreadsheets
• Direct experience with FedRAMP or FedRAMP 20x, or other public-sector / continuous-compliance authorizations
• Working knowledge of SOC 2, ISO 27001/27701, and NIST CSF/800-53, with the ability to map controls to evidence and crosswalk a single control across frameworks
• We encourage you to apply to a role even if your experience doesn’t fully match the job description