GRC Engineer

<h1>A little about us</h1><p style="min-height:1.5em"><a target="_blank" rel="noopener noreferrer nofollow" href="http://incident.io">incident.io</a> is the AI software reliability platform trusted by engineering teams at Notion, Linear, Ramp and 2,000+ companies who can't afford downtime.</p><p style="min-height:1.5em">The stakes are real, the talent is insane, and somehow it's a genuinely lovely place to work. We all pull our weight, go the extra mile, and put in the bit of magic most companies don't have time for, all while having fun and never taking ourselves too seriously.</p><p style="min-height:1.5em">We've raised $100+ million from Index Ventures, Insight Partners, and Point Nine, and we're growing fast. There's never been a better time to join.</p><p style="min-height:1.5em"></p><p style="min-height:1.5em"><strong>The role in one line</strong></p><p style="min-height:1.5em">Being a GRC Engineer at <a target="_blank" rel="noopener noreferrer nofollow" href="http://incident.io">incident.io</a> means turning compliance from spreadsheets and screenshots into something that just runs, so “can you prove it?” gets answered before anyone asks.</p><p style="min-height:1.5em"><strong>What that looks like day to day</strong></p><p style="min-height:1.5em">As a GRC Engineer at <a target="_blank" rel="noopener noreferrer nofollow" href="http://incident.io">incident.io</a>, you own how we prove we’re doing the right thing: our compliance programme, our customer security questionnaires, and the evidence behind both. One day you’re building an AI workflow that drafts questionnaire answers, the next you’re pushing our ISO 27001 work forward, the next you’re telling the product team what makes GRC painful.</p><p style="min-height:1.5em">Our GRC programme is young, and Slack is our system of record. You’ll make it scale, using AI-powered tooling and workflows to take the toil out of audits, evidence collection and customer questions.</p><p style="min-height:1.5em">Right now, that means:</p><ul style="min-height:1.5em"><li><p style="min-height:1.5em"><strong>ISO 27001.</strong> It’s in progress, and you’ll help raise the bar and get us over the line.</p></li><li><p style="min-height:1.5em"><strong>ISO 42001.</strong> We build AI products, so we want to manage AI responsibly. In your first two quarters or so, you’ll run a gap assessment against the standard.</p></li><li><p style="min-height:1.5em"><strong>Dogfooding.</strong> We use <a target="_blank" rel="noopener noreferrer nofollow" href="http://incident.io">incident.io</a> for our own security work, and you’ll drive product improvements that make GRC less painful for our customers too.</p></li></ul><p style="min-height:1.5em">You’ll work closely with the wider security team, engineering, legal and product.</p><p style="min-height:1.5em"><strong>Who you are</strong></p><ul style="min-height:1.5em"><li><p style="min-height:1.5em">You’ve run or contributed to a real compliance programme, ideally ISO 27001, and you know what it takes to get through an audit.</p></li><li><p style="min-height:1.5em">You’d rather automate evidence collection than chase people for screenshots.</p></li><li><p style="min-height:1.5em">You write code (Python, Go or similar) or bu