SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Eudia is an AI-powered legal tech platform backed by $105M in Series A funding, serving Fortune 500 legal teams. The company is building a category-defining platform that combines AI-driven automation with human expertise to transform legal operations from a cost center into a strategic growth driver.
As Security GRC Engineer, you will build and scale the technical backbone of Eudia's security and compliance program. This is a hands-on, engineering-focused role—not traditional compliance paperwork. You will translate control requirements from SOC 2, ISO 27001, HIPAA, and customer assessments into concrete technical and operational controls, then validate that they actually work in practice.
Key responsibilities include:
- Translating framework requirements into technical controls and validating their effectiveness
- Automating evidence collection and control testing so audit readiness is continuous, not annual
- Owning control mappings, risks, findings, exceptions, and remediation tracking across frameworks
- Partnering directly with Engineering, Infrastructure, IT, and Product to design controls that fit how Eudia builds and ships software
- Supporting security reviews, due diligence, and customer trust programs for large enterprise customers
- Managing vulnerability prioritization by severity, exploitability, reachability, and business impact
- Supporting AI governance for legal-AI products: model inventory, data handling, and emerging frameworks like ISO 42001
- Maintaining operational controls: access reviews, change management, logging, monitoring, vendor risk, and incident response
- Partnering with the ISSM on NIST 800-53 and FedRAMP work as the public-sector footprint grows
- Automating repeatable compliance work into infrastructure or product capability
The company values a bias to action: a working control that ships beats a perfect policy that does not. You will have real room to decide how the program gets built in a small, lean team.
Success in year one means: Engineering teams understand control requirements; audit evidence is increasingly automated; controls, risks, and exceptions have clear owners; SOC 2, ISO 27001, HIPAA, and customer assurance run as one system; new frameworks can be added without proportional manual work increases; auditors and customers receive clear, technically credible answers; and compliance becomes an accelerator for enterprise and public-sector growth.
REQUIREMENTS:
- 4+ years in security, GRC, security engineering, cloud security, or compliance engineering
- Hands-on understanding of modern SaaS and cloud environments: identity, cloud infrastructure, networking, logging, CI/CD, application security, data flows
- Ability to read and reason about Terraform, Kubernetes manifests, CI/CD configuration, IAM policies, and infrastructure-as-code artifacts
- Direct experience with at least two of: SOC 2, ISO 27001, HIPAA, or NIST CSF / 800-53
- Ability to go from framework requirement to technical implementation: inspect configuration, logs, architecture, or code; determine control effectiveness; work with Engineering to fix gaps
- Experience working shoulder-to-shoulder with engineers rather than running GRC as a separate function
- Hands-on experience using APIs, scripting, SQL, or similar tools to automate evidence collection and control testing
- Clear writing ability to explain controls to engineers, auditors, customers, and executives
- Strong judgment for separating real security risk from compliance noise
- Comfort in early-stage startup environments where building processes is the norm
NICE TO HAVE:
- Azure or AWS security and cloud-native infrastructure, including Kubernetes and container security
- Identity platforms such as Okta or Auth0
- SIEM, vulnerability management, SAST/SCA, endpoint, and cloud security tooling
- Compliance-as-code or automated continuous control monitoring
- Familiarity with AI/ML systems, LLM applications, or AI governance such as ISO 42001
- Exposure to FedRAMP or NIST 800-53 environments
- Experience supporting security diligence for Fortune 500 customers
