Senior GRC Engineer

About the role

You will lead the engineering behind our governance, risk and compliance (GRC) systems. You will turn security requirements into production controls, evidence pipelines and tests that show whether those controls operate as designed.

The Senior GRC Engineer works across security, software engineering and compliance. On one day you might build a pipeline that collects cloud configuration evidence or write a test that detects a failed control. On another day, you might trace a system change to the policies and requirements it affects.

You will work with the security, compliance, and legal teams to define the most pressing problems and deliver production solutions without detailed technical direction. And, more broadly, you will take initiative to close gaps that you identify in the course of your work.

What you will do

• Build production systems that collect, validate and preserve technical control evidence.

• Automate shared security controls when a central implementation is the right solution.

• Write tests that show whether controls operate as designed and continue to work over time.

• Connect requirements, controls, implementations, tests, evidence, policies and procedures.

• Detect missing, stale or incomplete evidence. Route failures to a named owner and keep a traceable record.

• Build workflows that identify drift between approved policies and technical implementations.

• Prepare reproducible evidence packages for the Compliance team.

• Join audits as a technical subject matter expert.

• Answer internal questions for go-to-market teams about our compliance and security posture.

• Help the Compliance and Legal teams assess how new requirements affect our security controls and systems.

• Build, deploy and operate approved GRC automation in our production environment.

• Keep the systems maintainable through version control, tests, monitoring and clear operating documentation.
  

What success looks like

Within your first few months, the first prioritised evidence pipelines and control tests should operate in production. The systems should show where evidence came from, whether it is current and when collection fails. The Compliance team should be able to reproduce selected for key requirements evidence without repeating the original manual work.

Over your first year, the Compliance team should receive complete and traceable technical evidence by the agreed dates. Important evidence and control failures should be visible before an audit. Manual collection and evidence rework should decrease as automation covers more of the highest-priority controls.

What you bring

You are a senior engineer who is comfortable owning a defined problem from design through production. You can work independently, explain your decisions and ask for help when a dependency or company-level decision blocks progress.

Bonus points

• Experience with ISO 27001, C5, SOC 2 and other security or quality management assessments.

• Experience with controls as code, policy as code or continuous control monitoring.

• Experience in healthcare, another regulated environment or a high-growth technology company.

• Experience with infrastructure as code, cloud security, identity systems or continuous integration and delivery pipelines.

• Experience integrating compliance platforms or integrated management systems with technical data sources.

• Experience building evidence systems with access, retention and auditability requirements.

• Experience using AI to support control mapping, evidence review or policy analysis with human approval and traceable outputs.
  

Benefits

• Competitive salary and company stock options.

• 30 days of paid holiday each year.

• 5,000 SEK wellness allowance, plus 6,000 SEK each year for other health-related initiatives.

• Parental leave top-up for new parents.

• Private medical insurance.

• Mental health support through Mindler.

• Pension programme.

• Regular social and team activities, including off-sites and seasonal events.

We review our benefits regularly and may change them from time to time.