SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Reflection AI is seeking a Governance, Risk, & Compliance (GRC) Engineer to build technical infrastructure that enables the compliance program to operate at engineering scale. This role sits at the intersection of compliance and engineering, translating policy requirements into automated technical controls.
You will design and build automated controls and monitoring systems that satisfy security framework requirements including SOC 2, ISO 27001, NIST 800-53/800-171, and CMMC. This includes access reviews, data minimization, model/data lineage tracking, and continuous evidence collection. You'll partner closely with Engineering, Security, and IT teams to implement technical requirements arising from security frameworks, export controls, and privacy regulations.
Key responsibilities include building and maintaining internal tooling that supports compliance workflows (intake forms, screening checks, reporting dashboards, GRC platform integrations such as Vanta), translating regulatory and policy requirements into concrete technical specifications, and supporting technical due diligence for customer security questionnaires, audits, and vendor assessments. You will maintain integrations between compliance/GRC systems and source-of-truth systems (identity, data infrastructure, model pipelines), and help scope technical environment separations or system boundaries required for regulatory compliance.
Reflection's Compliance and AI Governance function spans six pillars: AI Governance, Data Governance, Trade Compliance, Privacy Operationalization, Government Contracting Compliance, and Corporate Compliance. The team builds policies, controls, and operating rhythms that enable the company to move fast while remaining defensible with regulators, customers, and partners.
REQUIREMENTS:
- 3–6 years of software engineering, security engineering, or DevOps/infrastructure experience
- Hands-on experience supporting at least one security framework (SOC 2, ISO 27001, or NIST) as an engineer
- Comfortable writing production-quality code (Python or similar) and working with APIs/integrations
- Experience translating non-technical requirements (policy, regulatory, contractual) into technical implementation
- Familiarity with cloud infrastructure and identity/access management concepts
- Strong collaboration skills; able to work effectively with compliance, legal, and engineering stakeholders
- Experience building or maintaining GRC tooling, TPRM/vendor risk platforms, or compliance automation (e.g., Vanta or similar)
- Familiarity with one or more relevant frameworks: CMMC, NIST 800-171/800-53, SOC 2, ISO 27001, GDPR/CCPA technical requirements
- Experience with data governance or data lineage tooling, especially in ML/AI pipelines
- Background supporting a government contracting or regulated environment (preferred)
