Commercial GRC Engineer - Sr. Security Engineer I

Role

Smartsheet is seeking a Senior Security Engineer for its commercial GRC program to automate control monitoring, build evidence pipelines, and maintain continuous audit readiness. This is a hands-on engineering role focused on treating controls and mappings as code and making compliance easy for engineering teams to consume and contribute to.

The role reports to the Senior Director, GRC Engineering and may be based in Bellevue, WA, or remotely anywhere in the U.S. where Smartsheet is a registered employer.

Responsibilities

• Own automated evidence collection and continuous control monitoring for SOC 2, ISO 27001/27017/27701, HIPAA, and related frameworks across cloud, identity, endpoint, and SaaS systems.
• Express controls, tests, and cross-framework mappings as version-controlled, reviewable, testable, reusable code.
• Translate compliance requirements into technical control logic, workflows, and integrations with engineering, IT, and security teams.
• Participate in architecture and design reviews, define control acceptance criteria, and help teams build compliant-by-default infrastructure.
• Build self-service control status, guardrails, and compliance feedback in existing engineering tools, including CI/CD, Jira, and Slack.
• Evaluate whether controls reduce relevant risk and propose alternatives appropriate to the threat model and workload architecture.
• Support complete audit cycles, including evidence requests, evidence-library maintenance, auditor follow-ups, and remediation tracking.
• Build dashboards and reporting for control health, evidence freshness, and audit readiness.
• Reuse control mappings across frameworks to eliminate duplicate evidence collection.
• Diagnose recurring control failures and stale evidence, addressing underlying process, tooling, and ownership issues.
• Partner with the GRC Team Lead and SATellite engineering to extend the internal GRC platform's control, evidence, and risk-lifecycle capabilities.

Qualifications

• At least 4 years of experience in GRC engineering, security engineering, compliance automation, or IT audit support, including hands-on ownership of at least one full certification cycle such as SOC 2 or ISO 27001.
• Hands-on experience with GRC or compliance automation platforms such as Vanta, Drata, Secureframe, or a homegrown equivalent, including integration configuration and evidence pipelines.
• Experience with cloud security fundamentals, including AWS/GCP/Azure IAM, logging, encryption, and their relationship to control requirements.
• Solid working knowledge of SOC 2, ISO 27001, and HIPAA requirements and cross-framework control mapping; ISO 27017/27701 knowledge is ideal.
• Comfort with scripting or light development using Python, JavaScript, or similar languages to build integrations, automate API-based evidence collection, or extend GRC tooling.
• Strong written communication, including clear control, gap, and remediation documentation for auditors and engineers.
• A stakeholder-centric mindset focused on making compliance easy for engineers.
• Demonstrated ability to identify root causes of control failures or audit findings and drive durable fixes across teams.
• Ongoing legal eligibility to work in the U.S.

Compensation and Benefits

• Annual U.S. base salary range: $145,000–$193,750 USD. Actual compensation depends on experience, skills, and candidate location.
• Eligible for a market-competitive incentive opportunity.
• Subsidized medical, vision, and dental coverage; 401(k) match of 50% of contributions up to the first 6% of eligible pay; and a monthly work/productivity stipend.
• Flexible time away, sick time, 12 paid holidays, a paid volunteer day, and up to 24 weeks of parental leave.
• Company-sponsored life insurance and short- and long-term disability coverage.
• Professional development, Udemy courses, counseling membership, retail discounts, and a personal Smartsheet account.

Interview Accommodations

Candidates may request preparations to help ensure a comfortable and positive interview experience.