Qualys

Senior GRC Engineer

India · Work style not stated · Full time

Apply on the employer’s site ↗See how well you match this job

You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.

About the role

Description from the employer’s posting. Check the employer’s page for the current version.

EmployerQualys
LocationIndia
Work styleWork style not stated
Employment typeFull time
Employer posted28 Sep 2026

Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!

We are seeking Senior GRC Engineer to design, scale, and automate security governance, risk, and compliance frameworks. In this role, you will bridge the gap between compliance requirements and technical execution by automation for frameworks like NIST and ISO standards, building standardized control libraries, mapping multi-standard frameworks, and driving audit readiness.

If you have a strong foundation in risk management frameworks (NIST, ISO 27001/2) and an engineering-minded approach to control implementation and evidence automation, you will thrive in this position.

Key Responsibilities:

1. Framework Architecture & Control Management

Design Control Libraries: Build and maintain scalable, reusable security and compliance control libraries across the organization.
Framework Mapping: Translate complex regulatory and industry standards into standardized, actionable control definitions.
Risk & Policy Alignment: Map evidence requirements across overlapping compliance frameworks to eliminate redundancy and support the ISO & NIST Risk Management Frameworks.

Show full description

2. Compliance Automation & Evidence Engineering

Evidence Modeling: Define standardized evidence artifacts, validation logic, and assessment criteria for automated control evaluation.
Engineering Collaboration: Partner with engineering and security teams to build automated evidence collection pipelines and continuous compliance monitoring.
Data-Driven GRC: Build compliance content and metadata rule libraries using structured data formats (JSON/YAML) to scale platform capabilities.

3. Audit Readiness & Framework Implementation

NIST & ISO Implementation: Drive the practical design, implementation, and mapping of NIST (CSF / SP 800-53 / RMF / SOC 2) and ISO 27001/27002 control frameworks across technical environments.
Assessment Guidance: Define clear implementation guidance, control validation criteria, and self-assessment objectives for technical teams.
Continuous Improvement: Continuously refine GRC workflows, tooling, and framework content as standards and organizational needs evolve.

Qualifications & Skills:

Required Experience

Framework Implementation: Required hands-on experience implementing, operationalizing, and mapping ISO 27001/27002 and NIST SP 800-53 / NIST CSF / NIST RMF frameworks. Experience with PCI DSS, SOC 2, and CIS Controls is a strong plus.
Audit Readiness: Demonstrated ability to prepare technical environments and control owners for external audits through structured evidence management and control readiness models.
Risk Management: Deep understanding of ISO and NIST Risk Management Frameworks, including risk assessment methodologies, control testing, and remediation workflows.
Technical Aptitude: Understanding cloud platforms (AWS, Azure, or GCP), Identity & Access Management (IAM), and core security technologies.
Data & Automation: Experience working with structured data formats (JSON, YAML) to define validation logic or control metadata.
Evidence Management: Familiarity with evidence mapping, automated evidence validation, and modern compliance testing concepts.

Professional Competencies

Analytical Thinking: Ability to decompose complex regulatory texts into clear, practical engineering specifications.
Cross-Functional Collaboration: Excellent technical communication skills with the ability to bridge conversations between technical engineers, product teams, and management.
Documentation & Precision: High attention to detail in defining control definitions, test procedures, and architectural mappings.

Preferred Qualifications (Bonus)

Industry certifications such as CISA, CRISC, CISM, or CISSP.
Hands-on experience with GRC automation platforms (e.g., ServiceNow GRC, Vanta, Drata, Anecdotes, or custom GRC platforms).
Background in software engineering, security engineering, or compliance automation.

See how well you match this job Apply on the employer’s site ↗

Check your resume against this job Free, no sign-up. Nothing you paste is stored.

Staying safe while you apply

Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.

Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.

Preparing for this role with ROLIVA

Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
Prepare honestly.
Build interview stories and application drafts from your own evidence.
Keep track.
Save the role and record your own application status and follow-ups.

Create a free workspace or log in.