SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Immersive Labs is hiring a Cyber Security Engineer specializing in Governance, Risk & Compliance (GRC) to join the Product team. The company is a market-leading cyber resilience platform trusted by 30%+ of the Fortune 100, helping organizations test whether people, AI-enabled workflows, and security teams can perform securely under realistic pressure.
In this role, you will research, learn, and create engaging labs and ranges focused on GRC topics—from ISO standards to AI governance. You'll be a key player shaping the offensive security and AI pen test content roadmap, simulating attack paths and helping train users to counter the latest threats. Your mission is to evolve the governance space by creating emulated environments that simulate incidents within highly regulated sectors in an engaging, intuitive way.
You will design, build, and deliver practical and theory content to gamify governance, risk, and compliance, making it engaging and fun for end users. You'll shake up traditional training and teach complex concepts innovatively, educating GRC professionals on how to ensure security in their work.
Key responsibilities include:
- Utilizing GRC knowledge to plan, write, and improve security labs, challenges, and online learning content on the Immersive One platform
- Producing multi-format content using various teaching methods: practical exercises, questions, and gamification around GRC
- Peer reviewing cyber labs and ranges to ensure they function as expected
- Researching the latest GRC regulations and standards, compiling research to deliver practical and theory labs to users
- Compiling technical research into understandable, concise content for both technical and non-technical audiences
- Acting as a GRC subject matter expert for engineering and product teams, embedding "security and privacy by design" principles into the SDLC
Requirements:
- Proven experience working within a heavily regulated industry (FinTech, Healthcare, Government), cyber vendor, or consultancy, with demonstrated audit experience and practical understanding of how GRC works
- In-depth knowledge of MITRE ATLAS & D3FEND frameworks and their application to enterprise threat management
- Deep understanding of common compliance frameworks and security standards (NIST SP 800-53, NIST CSF, ISO 27001/27002, SOC 2)
- Strong technical understanding of networking, computing, and cyber security concepts
- Ability to use examples and analogies to simplify complex subjects; capacity to inhabit the mindset of target audiences to create realistic simulations
- Certifications such as CISSP, CISA, CRISC, or CISM are useful but not essential
- Natural problem solver and "tinkerer" who enjoys prototyping and iteration; attitude and approach as important as technical skills
