Security Engineer, GRC

Establishes GRC Engineering at Plaid, the role within the Security GRC team that turns largely manual, point-in-time compliance work into continuous, automated systems. The engineer defines how the discipline works, builds a version-controlled source of truth for controls, policies and framework mappings fed by live pipelines, runs continuous controls monitoring that flags drift, builds dashboards and SQL reporting on risk, automates evidence pulls, access reviews and questionnaires, and embeds policy-as-code checks in CI/CD with an eye on FedRAMP 20x.

Plaid wants strong Python and SQL, experience owning an internal tool end to end, AWS and log-query skills, Terraform plus OPA or Sentinel, knowledge of SOC 2, ISO 27001 and NIST, and real use of AI agents in team workflows. Hybrid from San Francisco.