GRC工程师
GRC Engineer
ABOUT CLERK
Clerk 旨在彻底解决用户身份层问题。我们是一个全球分布的团队，致力于为构建下一代 AI 软件提供一流的开发者基础设施。目前，我们为开发者提供全栈 React 组件和钩子，如 <SignUp/> https://clerk.dev/components/sign-up, <SignIn/> https://clerk.dev/components/sign-in, <UserProfile/> https://clerk.dev/components/user-profile, useUser https://clerk.com/docs/references/react/use-user, 和 useOrganization https://clerk.com/docs/references/react/use-organization。这些 API 让开发者能够构建难以实现的用户身份、组织管理和计费流程基础设施。我们认为一个组件胜过千个 API https://youtube.com/watch?v=enUuBY3HXh4。
Clerk 正在寻找一名高级 GRC 工程师加入我们的安全团队。我们的客户将 Clerk 放在他们的认证流程中间，他们中的每一个在使用前都会对我们进行自己的供应商审查。你将负责让这个审查变得容易的项目：控制措施、证据、审计和回答。
你将作为一线工程师工作。预计你会花大量时间编写集成、自动化和内部工具，以执行策略并自动化证据收集。目标是让整个项目始终保持最新状态，因此审计只是有人观察它，而不是每季度的紧急行动。
WHAT YOU'LL DO
- 全程负责 SOC 2 Type II 和 HIPAA：范围界定、控制设计、证据收集、审计 walkthrough 和整改
- 根据客户实际需求，界定并领导我们下一个框架（ISO 27001 是最可能的候选）
- 构建和维护从云服务提供商、SaaS 工具和内部系统向我们的 GRC 平台提供数据的集成
- 将控制措施转化为持续检查：政策即代码、配置漂移检测，以及从检测到关闭的控制失败流程
- 运行供应商安全审查计划，从接收申请到定期重新审查
- 负责安全问卷和信任中心的工作流程
- 维护风险登记册并进行风险评估，生成有文档记录的决策
- 将合规要求嵌入 SDLC 和变更管理中，通过工具强制执行，而不是通过提醒
- 每季度减少人类需要完成的通过审计的任务数量
WHO YOU ARE
- 5 年以上安全经验，有在 GRC 或类似领域构建自动化的实际经验
查看英文原文
ABOUT CLERK
Clerk is on a mission to solve the user identity layer once and for all. We are a globally distributed team dedicated to providing best-in-class developer infrastructure to build the next generation of AI software. Today, we provide developers with full-stack React components and hooks like <SignUp/> https://clerk.dev/components/sign-up, <SignIn/> https://clerk.dev/components/sign-in, <UserProfile/> https://clerk.dev/components/user-profile, useUser https://clerk.com/docs/references/react/use-user, and useOrganization https://clerk.com/docs/references/react/use-organization. These APIs allow developers to build hard-to-get-right infrastructure for user identity, organization management and billing flows. We believe that a component is worth a thousand APIs https://youtube.com/watch?v=enUuBY3HXh4.
Clerk is looking for a Senior GRC Engineer to join our Security Team. Our customers put Clerk in the middle of their authentication flow, and every one of them runs us through their own vendor review before they do. You'll own the program that makes that review easy: the controls, the evidence, the audits, and the answers.
You'll work as a hands-on engineer. Expect to spend a lot of your time writing integrations, automations, and internal tools that enforce policies and automate the evidence gathering. The goal is a program that's always current, so an audit is just someone observing it rather than a quarterly scramble.
WHAT YOU'LL DO
- Own SOC 2 Type II and HIPAA end to end: scoping, control design, evidence, auditor walkthroughs, and remediation
- Scope and lead our next framework (ISO 27001 is the likely candidate) based on what customers actually ask for
- Build and maintain the integrations that feed our GRC platform from our cloud providers, SaaS tools, and internal systems
- Turn controls into continuous checks: policy-as-code, config drift detection, and a control-failure pipeline from detection to closure
- Run the vendor security review program, from intake to periodic re-review
- Own the security questionnaire and trust center workflow
- Maintain the risk register and run risk assessments that produce documented decisions
- Embed compliance requirements into the SDLC and change management so they're enforced by tooling, not by reminders
- Reduce the number of things a human has to do to pass an audit every quarter
WHO YOU ARE
- 5+ years in security, with demonstrated experience building automation for a GRC or compliance program
- You've been the technical owner of at least one SOC 2 Type II or ISO 27001 audit and can tell us what you would do differently
- You write code, and you use LLMs to get more done without lowering the bar
- Hands-on with a GRC platform's API, not just its dashboard
- Cloud IAM and configuration depth on at least one provider, GCP preferred
- You can decide what evidence is sufficient and defend an automated test to an auditor
- Comfortable being one of a few security engineers; you can scope, prioritize, and ship without a lot of process around you
- Clear writer: policies, control narratives, and questionnaire answers are read by customers, so they have to be good
NICE-TO-HAVES
- Experience at an all-remote company
- Shipped LLM or agentic workflows in production for compliance work
- Experience at a developer-tools company
BENEFITS
- Competitive Salary – We want you to know that we value the skills and experience you bring to the table. We go out of our way to make sure that you feel fairly compensated.
- Equity Ownership – At Clerk, we believe in shared success. That's why we offer a stock option plan so that everyone can benefit from the growth and prosperity of the company.
- Health Coverage – We care about your well-being. That's why we offer top-tier health insurance to ensure that your health needs are fully met.
- Work Gear - Set up your ideal home office with the gear of your choice. At Clerk, we want to ensure that you have everything you need to perform at your best.
- Flexible Vacation Policy – We believe in work-life balance and trust you to take the time you need. Although we recommend 25 days per year, our vacation policy is unlimited. This is in addition to observing national holidays specific to your country of residence.
- Diverse and Inclusive Team – Join our exceptional, diverse, and globally distributed team at Clerk. We are committed to fostering an inclusive environment where everyone can contribute their best in building impactful products and tools for the modern web.