SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Tandem Health is a fast-scaling healthtech company reimagining healthcare by putting clinicians first. The platform is designed by clinicians for clinicians, addressing real-world pain points with intuitive medical notes and workflows that support patient care.
As Senior GRC Engineer, you will lead the engineering behind governance, risk and compliance (GRC) systems, translating security requirements into production controls, evidence pipelines and tests that verify control effectiveness. You will work across security, software engineering and compliance teams to define problems and deliver production solutions independently.
Key responsibilities include: building production systems that collect, validate and preserve technical control evidence; automating shared security controls; writing tests to verify controls operate as designed; connecting requirements, controls, implementations, tests, evidence, policies and procedures; detecting missing or stale evidence and routing failures to owners; building workflows to identify drift between approved policies and technical implementations; preparing reproducible evidence packages for compliance teams; joining audits as a technical subject matter expert; answering internal questions about compliance and security posture; assessing how new requirements affect security controls; and building, deploying and operating approved GRC automation in production.
Success means delivering prioritized evidence pipelines and control tests in production within months, with systems showing evidence provenance, currency and collection failures. The Compliance team should receive complete, traceable technical evidence by agreed dates, with important failures visible before audits. Manual collection and rework should decrease as automation covers high-priority controls.
You are a senior engineer comfortable owning defined problems from design through production, working independently while explaining decisions and asking for help when blocked. You can build and operate production software, automation or data pipelines; work with APIs, cloud services and structured data; translate security/compliance requirements into technical controls; design evidence records with clear provenance; build monitoring for collection failures and control issues; apply software engineering practices to compliance work; explain technical controls to diverse audiences; make sound engineering decisions; and balance automation with access control and operational safety.
Bonus experience includes ISO 27001, C5, SOC 2 assessments; controls as code or policy as code; healthcare or regulated environments; infrastructure as code and cloud security; compliance platform integration; evidence systems with access and retention requirements; and AI-supported control mapping with human approval.
