This listing doesn't post a salary. Most similar roles pay
$135,000–$212,500.
Based on 240 similar postings.
Employer
About Apex
Apex Fintech Solutions provides brokerage infrastructure and clearing services to financial services companies, enabling them to deliver investing, trading, and retirement solutions to their customers. Industry: Financial Technology & Brokerage Infrastructure
The GRC Engineer joins a team focused on building and operating the organization's governance, risk, and compliance program within the fintech sector. This hands-on role blends traditional GRC responsibilities with engineering-oriented tasks such as API integrations, data querying, and control automation. You will manage SOC 2 audits, NIST CSF assessments, and ISO 27001 readiness while maintaining a unified control framework to reduce redundant efforts. Day-to-day duties include building continuous compliance monitoring using platforms like Anecdotes, configuring automated evidence collection from cloud and identity systems, and performing SQL queries to validate data. You will also manage third-party risk assessments, draft security policies, and respond to due diligence questionnaires. Required skills include experience with GRC automation tools, proficiency in SQL, and the ability to translate technical findings for auditors and executives within a regulated financial environment.
Manage SOC 2, NIST CSF, and ISO 27001 audits by coordinating evidence collection and remediating findings.
Build and maintain automated compliance monitoring using GRC platforms and API integrations with cloud and identity systems.
Query and analyze security data using SQL to validate control effectiveness and produce audit-ready evidence.
Conduct third-party risk assessments and manage the vendor risk management process.
Respond to Due Diligence Questionnaires (DDQs) and maintain a trust center for customer security inquiries.
Draft, update, and review information security policies and procedures to ensure alignment with regulatory requirements.
Identify, score, and track enterprise risks while collaborating with engineering teams on remediation plans.
Automate manual GRC workflows and provide compliance metrics and reporting for leadership.
What we're looking for
2–5+ years of experience in GRC, information security compliance, IT audit, or a closely related field.
Hands-on experience as a practitioner preparing evidence for SOC 2 audits.
Working knowledge of NIST CSF and ISO 27001 or similar frameworks like PCI DSS.
Experience with GRC automation platforms such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, or ServiceNow GRC.
Comfort working with API integrations to ingest data for compliance monitoring and control building.
Working proficiency in SQL or similar query languages to analyze and validate compliance data.
Experience drafting and maintaining information security policies and procedures.
Experience in fintech, financial services, or regulated industries (preferred); familiarity with vendor risk management, cloud environments, scripting (Python), or relevant certifications like CISA or CISSP (preferred).