Sr. Security Assurance Engineer

6sense is a technology company focused on helping organizations drive growth, retention, and efficiency. The Senior Security Engineer, GRC builds automated security control monitoring, AWS evidence-collection systems, AI-native GRC workflows, and control-failure pipelines. The role also leads audit engagements, risk assessments, remediation validation, and GRC technology administration.

Responsibilities:

• Design, build, and own automated security control monitoring; write production-quality code (e.g., Python) under version control, peer review, and CI/CD, and treat control logic as a maintained software asset rather than a documented procedure
• Convert the control library from periodic, sample-based manual testing to continuous control monitoring (CCM): define the technical signal for each control, its test frequency, pass/fail thresholds, and alerting and escalation path
• Engineer self-service technical evidence collection in AWS using native services (Config, Security Hub, CloudTrail, Organizations/SCPs, IAM Access Analyzer, Systems Manager, EventBridge, Lambda, Athena/S3, CloudWatch), so control owners and auditors retrieve current evidence on demand without GRC acting as an intermediary
• Eliminate manual, screenshot-based, and ticket-driven evidence collection; retire manual test procedures as automated equivalents come online and document the transition so auditors can rely on it
• Redesign GRC processes to be AI-native; apply LLMs and agentic workflows to evidence review, control mapping, gap analysis, security questionnaire and customer due diligence response, policy and procedure drafting, and risk assessment triage, with explicit human-in-the-loop review, guardrails, and output validation
• Maintain a single normalized control library crosswalked across frameworks (ISO 27001, SOC 2, PCI DSS, SOX, GDPR, NIST) so that one automated test satisfies multiple obligations
• Build the control-failure pipeline end to end: automated detection, enrichment, ticket creation, owner routing, SLA tracking, remediation verification, and closure, including exception and risk acceptance handling where remediation is not viable
• Partner with Platform Engineering, DevOps, and IT to shift controls left into preventive guardrails: service control policies, AWS Config conformance packs, policy-as-code in CI/CD, and secure-by-default infrastructure patterns
• Instrument control health reporting: automation coverage, evidence freshness, control failure rates, mean time to remediate, and audit-readiness posture, surfaced in dashboards consumable by Security leadership and control owners
• Lead internal and external audit engagements with automated evidence as the primary artifact; defend automated test design, sampling logic, and the completeness and accuracy of system-generated evidence to auditors and assessors
• Oversee and execute complex control tests and third-party and operational security risk assessments, using tooling and AI-assisted analysis to increase coverage and reduce cycle time, and communicate results across multiple audiences with varying levels of sensitivity
• Develop issue and risk treatment plans with owners and validate remediation through automated re-testing rather than manual confirmation
• Set the technical bar for the team: peer review other GRC Engineers' automation, queries, and test logic, and provide feedback, guidance, and enablement so automation ownership is distributed rather than siloed
• Provide GRC technology administration, including integrations, API-based data flows, and user training and enablement
• Mature security governance, training and awareness programs, using automation to target and measure them
• Improve GRC handbook pages, procedures, playbooks, and technical design documentation, and maintain security program controlled documents
• Execute on quarterly individual Key Results that support team Objectives (OKRs)

Requirements:

• 5+ years of experience being part of a GRC or similar team
• 2+ years of hands-on experience building and maintaining automation, including proficiency in at least one scripting or programming language (Python preferred) and comfort working in Git, code review, and CI/CD
• Demonstrated hands-on AWS experience relevant to control monitoring and evidence generation: Config, Security Hub, CloudTrail, IAM, Organizations and SCPs, Lambda, EventBridge, S3/Athena, CloudWatch
• Experience retrieving, normalizing, and reconciling data across systems via APIs and SQL, and reasoning about the completeness and accuracy of that data
• Practical experience applying LLMs or AI agents to real workflows, including prompt and workflow design, output evaluation, and appropriate human review and guardrails
• Experience with security tools and cloud environments (e.g., GRC and compliance automation platforms, vulnerability scanners, SIEM, SOAR, AWS)
• Experience with industry frameworks, regulations and standards, such as ISO 27001, SOC 2, GDPR, PCI, SOX, NIST, etc
• Ability to determine what constitutes sufficient audit evidence and to defend automated control testing and system-generated evidence to auditors
• Automation-first by default; treats a recurring manual GRC task as an engineering problem, not a staffing problem
• Thinks like a builder and operates like an auditor: writes code that is maintainable and monitored, and control logic that is defensible and evidenced
• Uses AI aggressively but skeptically; leans on it for leverage while validating output and being explicit about where human judgment is required
• Designs for self-service so that GRC is not a bottleneck between control owners and their own evidence
• Evangelizes security best practices
• Works independently to maintain and improve overall company security posture
• Collaborates with cross-functional teams, particularly engineering and platform teams, and earns credibility with them technically
• Translates control intent and technical requirements into actionable, timebound, testable requests
• Drives projects and tasks to completion by following up on questions, deadlines, and requests for input
• Maintains accuracy of information
• Proactive prioritization and escalation to management
• Strong communication skills, including verbal, written, and presentation skills, and the ability to explain automated control design to both engineers and auditors
• Experience with infrastructure as code (Terraform, CloudFormation) and policy-as-code (OPA/Rego, AWS Config custom rules, cfn-guard, or similar)
• Experience implementing or operating continuous control monitoring at scale in a SaaS or multi-account cloud environment
• Experience integrating GRC or compliance automation platforms via API rather than through the UI
• Experience building internal self-service tooling used by engineers or control owners
• Big 4 (KPMG, Deloitte, PwC, EY) or similar experience
• Bachelor's degree in a related field
• Relevant industry certifications, such as CISSP, CISM, GIAC, AWS Certified Security – Specialty, or CCSK/CCSP, are highly desirable