# Security GRC Engineer
**Company:** [Cursor](https://scaleengineer.com/companies/cursor)
Security GRC Engineer at Cursor, responsible for designing and implementing governance, risk, and compliance programs including SOC 2, ISO 27001, and AI governance frameworks. This role combines technical implementation with strategic program development, involving compliance automation, evidence gathering, vendor security reviews, and cross-functional collaboration with Engineering, Legal, and GTM teams to build customer trust.
**Role:** Security Engineer
**Seniority:** Mid
**Locations:** San Francisco
**Salary:** 160000–220000 USD
[Apply](https://jobs.ashbyhq.com/cursor/1703501f-53a1-4307-93ec-84b723be92ef)
Canonical: https://scaleengineer.com/jobs/cursor/security-grc-engineer-1703501f
---
## Responsibilities

- Design and Scale GRC Programs: Design, implement, and scale comprehensive governance, risk, and compliance (GRC) programs aligned with SOC 2 Type II, ISO 27001, ISO 42001, and emerging AI governance standards. Develop and maintain compliance roadmaps that evolve with regulatory requirements and organizational growth.
- Automate Compliance Workflows: Lead automation of evidence gathering, control testing, and compliance documentation processes using scripts and automation tools. Reduce manual compliance overhead through intelligent workflow design and continuous improvement of control execution.
- Build Self-Serve Compliance Tools: Develop self-serve documentation platforms, dashboards, and tooling for Go-To-Market (GTM) teams to independently answer customer security and AI governance inquiries. Create internal knowledge repositories and customer-facing security documentation that scales support capacity.
- Conduct Security and Compliance Reviews: Lead security compliance assessments for new products, features, and vendor integrations. Use technical analysis and coding agents to verify that security configurations and AI governance implementations match documented claims and compliance requirements.
- Manage External Relationships and Communications: Own relationships with external audit firms, customers, and regulators as the primary security and AI governance program representative. Facilitate audit engagements, respond to security inquiries, and maintain audit readiness through proactive communication and documentation.
- Support Incident Response and Legal Functions: Draft and review customer-facing incident response communications during security events. Provide Security and AI governance guidance to Legal during contract negotiations and vendor evaluations, ensuring terms align with organizational risk tolerance and compliance posture.
- Maintain Corporate Security Policies: Establish, update, and enforce corporate security policies that align with GRC frameworks and regulatory requirements. Ensure policies remain current with industry best practices, emerging threats, and organizational changes in product and infrastructure.

## Requirements

### education

- {"name":"Bachelor's Degree in Computer Science, Cybersecurity, or Related Field","description":"Formal education foundation in computer science, cybersecurity, information security, or related technical discipline. Equivalent practical experience may substitute for formal degree."}
- {"name":"GRC or Security Certifications","description":"Professional certifications such as CISSP, CISM, CCSK, or SOC 2 audit experience demonstrating formal expertise in governance, risk, compliance, and security controls."}

### technical

- {"name":"SOC 2 Type II Expertise","description":"Deep knowledge of SOC 2 Type II certification requirements, control design, and evidence gathering. Experience scoping, planning, and executing SOC 2 audits with external audit firms."}
- {"name":"ISO 27001 and ISO 42001 Knowledge","description":"Comprehensive understanding of ISO 27001 information security management systems and ISO 42001 artificial intelligence management systems. Ability to design controls and documentation that satisfy both standards."}
- {"name":"Compliance Automation and Scripting","description":"Ability to write scripts or use automation tools to gather evidence, test controls, and generate compliance reports. Comfort with technical investigation and using coding agents to verify security configurations."}
- {"name":"Security Configuration Analysis","description":"Technical capability to trace external security claims back to actual product and infrastructure configurations. Ability to identify configuration drift, security gaps, and remediation paths."}
- {"name":"AI Governance Frameworks","description":"Familiarity with emerging AI governance standards, responsible AI principles, and AI-specific compliance requirements such as AIUC-1 guidelines and emerging regulatory frameworks."}
- {"name":"Cloud Infrastructure Security","description":"Understanding of cloud infrastructure security controls, identity and access management, logging and monitoring, and data protection mechanisms relevant to SaaS applications."}

### experience

- {"name":"3-6 Years of GRC or Security Compliance Experience","description":"Hands-on experience designing and managing governance, risk, and compliance programs. Practical background in control implementation, evidence gathering, and audit preparation for frameworks like SOC 2, ISO 27001, or similar standards."}
- {"name":"Cross-Functional Collaboration with Technical Teams","description":"Demonstrated ability to work effectively with Engineering, Infrastructure, Product, Legal, and GTM teams. Strong track record of translating security requirements into technical solutions and vice versa."}
- {"name":"Vendor and Audit Management","description":"Experience managing relationships with external auditors, security consultants, and compliance vendors. Ability to coordinate audits, respond to audit findings, and maintain positive stakeholder relationships."}
- {"name":"SaaS or Technology Company Background","description":"Experience in SaaS, software, or high-growth technology companies where security compliance is critical for customer trust and market positioning."}

## Skills

### required

- {"name":"GRC Framework Design and Implementation","description":"Expert-level ability to design, implement, and maintain comprehensive governance, risk, and compliance programs aligned with SOC 2, ISO 27001, ISO 42001, and regulatory requirements."}
- {"name":"Compliance Automation and Scripting","description":"Technical proficiency in automation, scripting, and using tools to streamline evidence gathering, control testing, and compliance documentation. Ability to think programmatically about compliance workflows."}
- {"name":"Security Configuration Verification","description":"Strong technical investigation skills to verify that security configurations match documented claims. Ability to use technical tools, coding agents, and curiosity-driven analysis to identify and remediate security gaps."}
- {"name":"Audit and External Compliance Management","description":"Extensive experience preparing for and managing external audits, coordinating with audit firms, and maintaining ongoing audit readiness. Ability to effectively communicate security posture to external stakeholders."}
- {"name":"Cross-Functional Communication","description":"Excellent ability to translate between technical security concepts and business/legal requirements. Comfortable facilitating discussions between Engineering, Legal, GTM, auditors, and regulators."}
- {"name":"Technical Troubleshooting and Problem-Solving","description":"Strong analytical and troubleshooting mindset. Ability to investigate complex technical security issues, trace problems to root causes, and develop scalable solutions."}
- {"name":"AI Governance and Responsible AI Principles","description":"Understanding of AI governance frameworks, responsible AI principles, and emerging AI-specific compliance requirements. Ability to apply governance concepts to AI/ML systems and products."}

### preferred

- {"name":"AI/ML Security Knowledge","description":"Familiarity with security and governance considerations unique to artificial intelligence and machine learning systems, including model security, data governance, and AI-specific compliance frameworks."}
- {"name":"Incident Response Communication","description":"Experience drafting customer-facing security incident communications and managing security incident disclosures. Understanding of regulatory disclosure requirements and crisis communication best practices."}
- {"name":"Developer Tools and IDE Security","description":"Understanding of security considerations specific to developer tools, integrated development environments (IDEs), and software development lifecycle security for AI-assisted coding platforms."}
- {"name":"Contract Negotiation Support","description":"Experience providing security and compliance guidance during contract negotiations, security assessment responses, and vendor risk assessments."}
- {"name":"Python or Bash Scripting","description":"Proficiency in Python, Bash, or other scripting languages for building compliance automation tools and security configuration verification scripts."}
- {"name":"Vendor Risk Assessment and Management","description":"Experience evaluating vendor security postures, conducting third-party risk assessments, and managing vendor compliance questionnaires and security reviews."}
- {"name":"Policy and Documentation Development","description":"Strong writing skills and experience developing clear, compliant security policies, procedures, and documentation that communicate security requirements effectively to technical and non-technical audiences."}

## Tech stack

### tools

- {"name":"GRC Platforms and Compliance Management Tools","description":"Proficiency with platforms like Drata, Vanta, Workiva, or similar compliance automation tools for managing evidence, testing controls, and preparing audits."}
- {"name":"Cloud Infrastructure Tools","description":"Experience with AWS, Google Cloud, or Azure management consoles and infrastructure-as-code tools (Terraform, CloudFormation) for verifying security configurations."}
- {"name":"Audit Management and Documentation Tools","description":"Proficiency with tools for managing audit workflows, storing compliance evidence, tracking control testing, and communicating with external auditors."}
- {"name":"Incident Response and Communication Tools","description":"Familiarity with incident management and communication platforms for coordinating security incident response and customer communications."}
- {"name":"Code and Repository Analysis Tools","description":"Ability to use GitHub, security scanning tools, and code analysis platforms to verify security implementations and access controls."}

### others

- {"name":"AI and Coding Agent Familiarity","description":"Comfort using AI-powered coding agents and assistants (aligned with Cursor's mission) to automate security verification, evidence gathering, and compliance testing workflows."}
- {"name":"Regulatory Knowledge and Compliance Standards","description":"Deep understanding of SOC 2, ISO standards, GDPR, CCPA, and emerging AI governance regulations relevant to SaaS companies and AI-focused organizations."}
- {"name":"Security Architecture Concepts","description":"Foundational knowledge of security architecture, identity and access management, encryption, logging, and monitoring as applied to SaaS products and cloud infrastructure."}

### databases

- {"name":"Cloud Data Stores and Logging Platforms","description":"Interaction with cloud provider databases (AWS RDS, Google Cloud Firestore, etc.) for storing and analyzing compliance evidence, audit logs, and control test results."}
- {"name":"Audit and Compliance Databases","description":"Familiarity with GRC platforms and compliance management tools that store control evidence, track remediation, and manage audit workflows."}

### languages

- {"name":"Python","description":"Used for building compliance automation scripts, evidence gathering tools, and security configuration verification workflows."}
- {"name":"Bash/Shell Scripting","description":"Utilized for infrastructure automation, control testing, and system configuration verification within cloud environments."}
- {"name":"SQL","description":"Applied for querying compliance databases, extracting audit evidence, and analyzing security logs and configuration data."}

### frameworks

- {"name":"SOC 2 Type II Framework","description":"Primary compliance framework guiding control design, evidence gathering, and audit preparation for customer trust and market credibility."}
- {"name":"ISO 27001 Information Security Management System","description":"Comprehensive framework defining security controls, risk assessment, and compliance requirements for information security governance."}
- {"name":"ISO 42001 AI Governance Framework","description":"Emerging framework for managing AI and machine learning systems governance, ensuring responsible and compliant AI implementation."}

## Benefits

### benefits

- {"name":"Equity and Stock Options","description":"Competitive equity grants providing ownership stake in Cursor's growth as an early-stage AI-focused company with strong market positioning."}
- {"name":"Comprehensive Health Insurance","description":"Medical, dental, and vision coverage for employees and eligible dependents, with competitive employer contribution rates."}
- {"name":"Flexible Work Environment","description":"Opportunity to work with a small, talent-dense team in a flat organizational structure that values innovation and rapid iteration on important security and compliance challenges."}
- {"name":"Professional Development","description":"Access to training, certifications, and learning resources to advance expertise in GRC frameworks, AI governance, and emerging compliance standards relevant to the role."}
- {"name":"San Francisco Bay Area Location","description":"Based in San Francisco with access to the broader tech and security community, industry events, and networking opportunities with leading companies and security professionals."}

## Compensation

- **max:** 220000
- **min:** 160000
- **currency:** USD
- **stockOptions:** true

## Interview process

### steps

- {"name":"Initial Screening","description":"Brief conversation to understand your background, GRC experience, and interest in Cursor's security and AI governance challenges. Alignment check on values and work style within a flat, fast-moving organization."}
- {"name":"Technical Interview - GRC and Compliance Design","description":"Deep dive into your experience designing GRC programs, implementing SOC 2 or ISO 27001 controls, and managing compliance automation. Discuss specific projects, frameworks, and how you approached compliance challenges."}
- {"name":"Technical Interview - Security Configuration and Verification","description":"Assessment of your ability to trace security claims to technical implementation. Possible discussion of how you'd approach verifying that product and infrastructure configurations align with documented security posture."}
- {"name":"Cross-Functional Collaboration Discussion","description":"Conversation with team members from Engineering or GTM to evaluate communication skills, ability to translate between technical and business contexts, and experience with cross-functional GRC initiatives."}
- {"name":"Onsite Interview and Project Work","description":"Full-day onsite at Cursor's San Francisco office including small hands-on project related to GRC automation or compliance design, team meetings to discuss ideas and approach, and cultural fit evaluation with flat, talented team."}

## Full description
Our mission is to automate coding. The first step in our journey is to build the best tool for professional programmers, using a combination of inventive research, design, and engineering. Our organization is very flat, and our team is small and talent dense. We particularly like people who are truth-seeking, passionate, and creative. We enjoy spirited debate, crazy ideas, and shipping code.

## **About the Role**

Security GRC Engineers design, implement, and scale our governance, risk, and compliance (GRC) program. You'll lead automation of compliance workflows, build self-serve tools to enable GTM teams, and ensure our products and infrastructure meet the highest security standards. This role blends technical implementation with strategic program development, directly shaping how we build trust with customers.

**You may be a fit if**

* You have experience with GRC frameworks such as SOC 2, ISO 27001, ISO 42001, and AIUC-1.
* You're comfortable tracing an external claim back to how the product and infrastructure are actually configured — you use coding agents and curiosity to confirm that what we say is what we do, flag issues that affect the security and AI governance program, and drive them to the right outcome.
* You have strong cross-functional collaboration skills, especially with Engineering, Legal, GTM, Trust & Safety, auditors, and regulators.

**Sample projects include**

* Automate evidence gathering and continuous control testing.
* Own the relationship with audit firms and customers — you're the person who explains the security and AI governance program and earns their trust in it.
* Conduct security compliance reviews for new products, features, and vendors.
* Support Legal in contract negotiations with timely, accurate guidance on security and AI governance terms.
* Support incident response communications — draft and review customer-facing updates during security incidents.
* Build self-serve documentation and tools to answer customer security and AI governance inquiries.
* Maintain corporate security policies.

**Applying**

If there appears to be a fit, we'll reach out to schedule 2–3 short technicals. After that, we'll schedule an onsite at our office, where you'll work on a small project, discuss ideas, and meet the team.