GRC Engineer
Reflection is an AI research lab building open frontier models and a full AI stack for developers, enterprises, and public-sector users.
Funding history
About Reflection
Reflection develops open-weight AI models, open-source software for customizing and running agents, AI-factory infrastructure, and related solutions. Its current research emphasizes large language models, reinforcement learning, and agentic reasoning.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will design automated controls, monitoring, and evidence collection for security frameworks. You will translate policy and regulatory requirements into technical specifications, build compliance tooling and integrations, support due diligence and audits, and partner with engineering, security, IT, and compliance stakeholders on technical controls and regulated system boundaries.
Requirements
- 3-6 years of software engineering, security engineering, or DevOps and infrastructure experience
- Experience supporting SOC 2, ISO 27001, or NIST as an engineer
- Experience writing production-quality Python or similar code
- Experience with APIs and integrations
- Ability to translate policy, regulatory, and contractual requirements into technical implementations
- Familiarity with cloud infrastructure and identity and access management
- Experience with GRC tooling, vendor risk platforms, or compliance automation
- Familiarity with CMMC, NIST 800-171, NIST 800-53, SOC 2, ISO 27001, or GDPR and CCPA technical requirements
- Experience with data governance or data-lineage tooling in ML and AI pipelines
- Experience supporting government contracting or regulated environments
Responsibilities
- Design and build automated controls and monitoring for security-framework requirements
- Partner with Engineering, Security, and IT to implement technical compliance requirements
- Build and maintain tooling for compliance workflows and GRC platform integrations
- Translate regulatory and policy requirements into technical specifications
- Support technical due diligence, customer security questionnaires, audits, and vendor assessments
- Maintain integrations between GRC systems and source-of-truth systems
- Support technical environment separations and system boundaries required for regulatory compliance
Benefits
- Stock options
- Medical, dental, vision, and life insurance
- Annual wellness allowance
- Daily office lunch and dinner
- 22 weeks of paid parental leave
- Unlimited paid time off in the United States
- 30 vacation days in the United Kingdom
- Visa sponsorship support
- Regular off-sites, happy hours, and team celebrations
