SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 155,000 - 185,000 / annual
Cape is America's privacy-first mobile carrier founded in 2022, building a secure network from the ground up to give consumers, businesses, and government agencies control over their personal data. The company closed Series C funding in March 2026 and is scaling rapidly.
You will join Cape's GRC function as a GRC Engineer, reporting to the Head of Security. This role sits at the intersection of security, engineering, and compliance—translating regulatory and contractual requirements into automated controls, policies, and pragmatic engineering solutions. You will be equally comfortable writing policy as you are writing scripts to enforce it.
Key responsibilities include:
- Design, build, and maintain automated systems for continuous controls monitoring across cloud infrastructure (AWS/GCP/Azure), CI/CD, and SaaS stack
- Own and mature compliance programs end-to-end (SOC 2 Type II, CMMC, and future frameworks), including audit prep, evidence collection, and remediation tracking
- Provide subject matter expertise in risk assessment, controls design, security policy, vendor/third-party risk, access review automation, and audit management
- Proactively assess technical and organizational risk, make data-driven recommendations, and implement scalable solutions
- Execute full range of GRC duties—from writing policy to shipping automation that enforces it
- Collaborate closely with Security and Engineering to implement solutions across risk management, policy, and compliance tooling
- Ensure successful rollout of key GRC programs such as risk registers, access reviews, vendor risk assessments, and audit cycles
- Support customers and prospects through security questionnaires, due diligence requests, and trust-building conversations; build tooling to accelerate this process
Cape operates with a flat structure emphasizing high trust, high expectations, and collaboration across organizational lines. You will work with world-class engineers, architects, and visionaries to solve mission-critical problems.
REQUIREMENTS:
- 3+ years in GRC engineering, security engineering, or compliance with hands-on technical work; startup experience preferred
- Demonstrable expertise across compliance frameworks (SOC 2, CMMC, FedRAMP, NIST CSF, GDPR), including how regulatory and contractual requirements translate into technical controls and engineering decisions
- Successful track record of designing and implementing risk or compliance programs with clear, auditable processes that adapt as business and regulatory landscape change
- Strong prioritization and project management skills, especially when running audits against real deadlines
- Experience partnering with and influencing engineering and security leaders to drive risk decisions and audit outcomes; ability to build trust with both engineers and auditors
- Clear communication style and ability to translate technical risk into business terms for different audiences
- Ability to see all sides of a risk tradeoff, remain objective, and drive issues to resolution through ambiguity
- BA/BS in a related field or equivalent practical experience; relevant security or audit certifications (CISSP, CISA, CRISC, or similar) a plus
- Bonus: Proficiency in at least one scripting or programming language (Python, Go, TypeScript) to automate evidence collection, monitoring, and reporting
- Bonus: Experience standing up a GRC program or compliance automation tooling (Vanta, Drata, Secureframe, OneTrust) from scratch; working knowledge of cloud platforms (AWS, GCP, Azure) and their native security and logging tooling
