GRC Engineer

About WorkOS 🚀 WorkOS builds modern developer tools and APIs that make it easy for companies to become Enterprise Ready. Our platform powers authentication, identity, authorization, and other critical infrastructure that developers need to securely scale their products to large organizations. We recently raised a $100M Series C, valuing the company at $2B, led by Meritech and Sapphire with participation from Greenoaks, Craft, Abstract, and Audacious. WorkOS powers enterprise features for many of the fastest-growing AI companies, including OpenAI, Cursor, and Perplexity, Vercel, and Plaid. As AI reshapes software, WorkOS is at the frontier of Human and Agent Authentication, Identity, and Access Control—helping companies answer a new critical question: who are your agents, and what are they allowed to do? Our fast-growing customer base includes hundreds of modern software companies building the next generation of enterprise-ready products. ABOUT THE SECURITY TEAM The Security team at WorkOS is responsible for keeping the data and identities of hundreds of millions of users secure. Security is fundamental to our products, and customer trust is the foundation of our success. We are a highly collaborative group with a strong technical mindset. Our security program is shaped by hands-on experience attacking and defending systems, and applying lessons from across the industry. We embrace the latest advancements in practices and tooling that make modern security teams effective. Today, our team spans product security, cloud security, and detection & response. We are expanding our internal GRC function to scale our compliance, risk, and customer trust programs as we grow. ABOUT THE ROLE We are looking for a GRC Engineer to lead and own our Governance, Risk, and Compliance program. WorkOS has foundational compliance in place; SOC 2, HIPAA, GDPR, PCI-DSS SAQ D, and a growing set of customer and regulatory obligations. What we are looking for now is a leader for our compliance function: someone who can build on the trust our enterprise customers have placed in us, own our existing frameworks, and drive us into the next tier of certifications. You will work with security leadership to navigate our GRC program. You will help set the strategy, shape the roadmap, and build the systems and culture that make compliance a byproduct of how we build software. This is a remote or hybrid position, open to candidates based in Canada or the United States. WHAT YOU'LL DO - Own our compliance function. Frameworks, policies, controls, and audits are yours. Make compliance part of how we build and ship, not a separate track. - Build the GRC culture. Own security awareness, internal education, and the cross-functional work that makes compliance a shared responsibility across the company. - Lead our next certifications. Drive readiness and on-going compliance for future frameworks like ISO 27001, EU-US DPF, FedRAMP; scoping the controls, documentation, and collaborating across the organization to make it happen. - Partner directly with customers. Be the voice of our compliance program to our customers. Support audits, enable sales on compliance-gated deals, and build on the trust we've established with the companies that depend on us. - Own risk across WorkOS. Run our risk and third-party risk programs. Identify risks as they emerge, drive remediation, and surface signal to leadership. - Scale through automation. Reduce manual toil wherever it hides. Design processes, tooling, and AI-assisted workflows so the compliance function scales without scaling headcount. WHO YOU ARE - A trusted advisor, internally and externally. You work fluidly with customers, engineering, legal, sales, and auditors. You can explain a control, defend a design decision, manage a difficult customer conversation, and communicate clearly, in writing. - A pragmatic, forward-thinker. You spot audit tight spots before they arrive, have the experience to work through them, and how to fu...