Security GRC Engineer
Security Engineer · Mid · Full Time
Opens Cursor's application page
Role
What you'll do.
Security GRC Engineer at Cursor, responsible for designing and implementing governance, risk, and compliance programs including SOC 2, ISO 27001, and AI governance frameworks. This role combines technical implementation with strategic program development, involving compliance automation, evidence gathering, vendor security reviews, and cross-functional collaboration with Engineering, Legal, and GTM teams to build customer trust.
Responsibilities
- Design and Scale GRC Programs: Design, implement, and scale comprehensive governance, risk, and compliance (GRC) programs aligned with SOC 2 Type II, ISO 27001, ISO 42001, and emerging AI governance standards. Develop and maintain compliance roadmaps that evolve with regulatory requirements and organizational growth.
- Automate Compliance Workflows: Lead automation of evidence gathering, control testing, and compliance documentation processes using scripts and automation tools. Reduce manual compliance overhead through intelligent workflow design and continuous improvement of control execution.
- Build Self-Serve Compliance Tools: Develop self-serve documentation platforms, dashboards, and tooling for Go-To-Market (GTM) teams to independently answer customer security and AI governance inquiries. Create internal knowledge repositories and customer-facing security documentation that scales support capacity.
- Conduct Security and Compliance Reviews: Lead security compliance assessments for new products, features, and vendor integrations. Use technical analysis and coding agents to verify that security configurations and AI governance implementations match documented claims and compliance requirements.
- Manage External Relationships and Communications: Own relationships with external audit firms, customers, and regulators as the primary security and AI governance program representative. Facilitate audit engagements, respond to security inquiries, and maintain audit readiness through proactive communication and documentation.
- Support Incident Response and Legal Functions: Draft and review customer-facing incident response communications during security events. Provide Security and AI governance guidance to Legal during contract negotiations and vendor evaluations, ensuring terms align with organizational risk tolerance and compliance posture.
- Maintain Corporate Security Policies: Establish, update, and enforce corporate security policies that align with GRC frameworks and regulatory requirements. Ensure policies remain current with industry best practices, emerging threats, and organizational changes in product and infrastructure.
Qualifications
What we look for.
Technical
SOC 2 Type II Expertise
Deep knowledge of SOC 2 Type II certification requirements, control design, and evidence gathering. Experience scoping, planning, and executing SOC 2 audits with external audit firms.
ISO 27001 and ISO 42001 Knowledge
Comprehensive understanding of ISO 27001 information security management systems and ISO 42001 artificial intelligence management systems. Ability to design controls and documentation that satisfy both standards.
Compliance Automation and Scripting
Ability to write scripts or use automation tools to gather evidence, test controls, and generate compliance reports. Comfort with technical investigation and using coding agents to verify security configurations.
Security Configuration Analysis
Technical capability to trace external security claims back to actual product and infrastructure configurations. Ability to identify configuration drift, security gaps, and remediation paths.
AI Governance Frameworks
Familiarity with emerging AI governance standards, responsible AI principles, and AI-specific compliance requirements such as AIUC-1 guidelines and emerging regulatory frameworks.
Cloud Infrastructure Security
Understanding of cloud infrastructure security controls, identity and access management, logging and monitoring, and data protection mechanisms relevant to SaaS applications.
Education
Bachelor's Degree in Computer Science, Cybersecurity, or Related Field
Formal education foundation in computer science, cybersecurity, information security, or related technical discipline. Equivalent practical experience may substitute for formal degree.
GRC or Security Certifications
Professional certifications such as CISSP, CISM, CCSK, or SOC 2 audit experience demonstrating formal expertise in governance, risk, compliance, and security controls.
Experience
3-6 Years of GRC or Security Compliance Experience
Hands-on experience designing and managing governance, risk, and compliance programs. Practical background in control implementation, evidence gathering, and audit preparation for frameworks like SOC 2, ISO 27001, or similar standards.
Cross-Functional Collaboration with Technical Teams
Demonstrated ability to work effectively with Engineering, Infrastructure, Product, Legal, and GTM teams. Strong track record of translating security requirements into technical solutions and vice versa.
Vendor and Audit Management
Experience managing relationships with external auditors, security consultants, and compliance vendors. Ability to coordinate audits, respond to audit findings, and maintain positive stakeholder relationships.
SaaS or Technology Company Background
Experience in SaaS, software, or high-growth technology companies where security compliance is critical for customer trust and market positioning.
Skills
Required
GRC Framework Design and Implementation
Expert-level ability to design, implement, and maintain comprehensive governance, risk, and compliance programs aligned with SOC 2, ISO 27001, ISO 42001, and regulatory requirements.
Compliance Automation and Scripting
Technical proficiency in automation, scripting, and using tools to streamline evidence gathering, control testing, and compliance documentation. Ability to think programmatically about compliance workflows.
Security Configuration Verification
Strong technical investigation skills to verify that security configurations match documented claims. Ability to use technical tools, coding agents, and curiosity-driven analysis to identify and remediate security gaps.
Audit and External Compliance Management
Extensive experience preparing for and managing external audits, coordinating with audit firms, and maintaining ongoing audit readiness. Ability to effectively communicate security posture to external stakeholders.
Cross-Functional Communication
Excellent ability to translate between technical security concepts and business/legal requirements. Comfortable facilitating discussions between Engineering, Legal, GTM, auditors, and regulators.
Technical Troubleshooting and Problem-Solving
Strong analytical and troubleshooting mindset. Ability to investigate complex technical security issues, trace problems to root causes, and develop scalable solutions.
AI Governance and Responsible AI Principles
Understanding of AI governance frameworks, responsible AI principles, and emerging AI-specific compliance requirements. Ability to apply governance concepts to AI/ML systems and products.
Preferred
AI/ML Security Knowledge
Nice to haveFamiliarity with security and governance considerations unique to artificial intelligence and machine learning systems, including model security, data governance, and AI-specific compliance frameworks.
Incident Response Communication
Nice to haveExperience drafting customer-facing security incident communications and managing security incident disclosures. Understanding of regulatory disclosure requirements and crisis communication best practices.
Developer Tools and IDE Security
Nice to haveUnderstanding of security considerations specific to developer tools, integrated development environments (IDEs), and software development lifecycle security for AI-assisted coding platforms.
Contract Negotiation Support
Nice to haveExperience providing security and compliance guidance during contract negotiations, security assessment responses, and vendor risk assessments.
Python or Bash Scripting
Nice to haveProficiency in Python, Bash, or other scripting languages for building compliance automation tools and security configuration verification scripts.
Vendor Risk Assessment and Management
Nice to haveExperience evaluating vendor security postures, conducting third-party risk assessments, and managing vendor compliance questionnaires and security reviews.
Policy and Documentation Development
Nice to haveStrong writing skills and experience developing clear, compliant security policies, procedures, and documentation that communicate security requirements effectively to technical and non-technical audiences.
Tech stack
Languages
Frameworks
Databases
Tools
Other
Compensation
Pay and benefits.
Base·USD 160,000 – 220,000
Equity·Stock options
Benefits
Equity and Stock Options
Competitive equity grants providing ownership stake in Cursor's growth as an early-stage AI-focused company with strong market positioning.
Comprehensive Health Insurance
Medical, dental, and vision coverage for employees and eligible dependents, with competitive employer contribution rates.
Flexible Work Environment
Opportunity to work with a small, talent-dense team in a flat organizational structure that values innovation and rapid iteration on important security and compliance challenges.
Professional Development
Access to training, certifications, and learning resources to advance expertise in GRC frameworks, AI governance, and emerging compliance standards relevant to the role.
San Francisco Bay Area Location
Based in San Francisco with access to the broader tech and security community, industry events, and networking opportunities with leading companies and security professionals.
Process
Interview steps.
- 01
Initial Screening
Brief conversation to understand your background, GRC experience, and interest in Cursor's security and AI governance challenges. Alignment check on values and work style within a flat, fast-moving organization.
- 02
Technical Interview - GRC and Compliance Design
Deep dive into your experience designing GRC programs, implementing SOC 2 or ISO 27001 controls, and managing compliance automation. Discuss specific projects, frameworks, and how you approached compliance challenges.
- 03
Technical Interview - Security Configuration and Verification
Assessment of your ability to trace security claims to technical implementation. Possible discussion of how you'd approach verifying that product and infrastructure configurations align with documented security posture.
- 04
Cross-Functional Collaboration Discussion
Conversation with team members from Engineering or GTM to evaluate communication skills, ability to translate between technical and business contexts, and experience with cross-functional GRC initiatives.
- 05
Onsite Interview and Project Work
Full-day onsite at Cursor's San Francisco office including small hands-on project related to GRC automation or compliance design, team meetings to discuss ideas and approach, and cultural fit evaluation with flat, talented team.
Full posting
Original listing.
Our mission is to automate coding. The first step in our journey is to build the best tool for professional programmers, using a combination of inventive research, design, and engineering. Our organization is very flat, and our team is small and talent dense. We particularly like people who are truth-seeking, passionate, and creative. We enjoy spirited debate, crazy ideas, and shipping code.
About the Role
Security GRC Engineers design, implement, and scale our governance, risk, and compliance (GRC) program. You'll lead automation of compliance workflows, build self-serve tools to enable GTM teams, and ensure our products and infrastructure meet the highest security standards. This role blends technical implementation with strategic program development, directly shaping how we build trust with customers.
You may be a fit if
You have experience with GRC frameworks such as SOC 2, ISO 27001, ISO 42001, and AIUC-1.
You're comfortable tracing an external claim back to how the product and infrastructure are actually configured — you use coding agents and curiosity to confirm that what we say is what we do, flag issues that affect the security and AI governance program, and drive them to the right outcome.
You have strong cross-functional collaboration skills, especially with Engineering, Legal, GTM, Trust & Safety, auditors, and regulators.
Sample projects include
Automate evidence gathering and continuous control testing.
Own the relationship with audit firms and customers — you're the person who explains the security and AI governance program and earns their trust in it.
Conduct security compliance reviews for new products, features, and vendors.
Support Legal in contract negotiations with timely, accurate guidance on security and AI governance terms.
Support incident response communications — draft and review customer-facing updates during security incidents.
Build self-serve documentation and tools to answer customer security and AI governance inquiries.
Maintain corporate security policies.
Applying
If there appears to be a fit, we'll reach out to schedule 2–3 short technicals. After that, we'll schedule an onsite at our office, where you'll work on a small project, discuss ideas, and meet the team.
Redirects to Cursor's application page.
Other roles
More at Cursor.
Field Engineer, Commercial
Mid
Field Engineer, Commercial
Mid
Software Engineer, Compute Infra
Senior
Software Engineer, Research Tooling
Mid
Software Engineer, Model Lifecycle and Signals
Senior