Principal GRC Business Engineer
Architects and matures global GRC programs, translating regulations into security policies and automating risk controls for a cybersecurity leader.
- Compensation
- $167.6K–$271.2K / yr
- Location
- Office - USA - CA - Headquarters
- Work setup
- Not specified
- Seniority
- Principal
- Employment
- Full time
- Experience
- 6+ years
- Category
- Security
- Posted
Skills
Must have
- 10+ years in InfoSec or IT Risk, 6+ years in GRC, security governance, and enterprise risk engineering
- Bachelor’s or Master’s in CS, Cybersecurity, MIS, or equivalent experience
- CISSP, CRISC, CISM, or CISA certification
- Deep knowledge of ISO 27001/2, NIST SP 800-53, NIST CSF, SOC 2 Type II, PCI-DSS, GDPR
- Experience developing risk management processes and executive-level reporting
- Hands-on GRC tool configuration (workflows, routing, automations)
- Multi-cloud experience (AWS, Azure, GCP)
- Exceptional communication and cross-functional stakeholder influence
- Adept at navigating ambiguity and solving complex challenges
Nice to have
- CCSP or CIPP certification
- AI governance frameworks experience (NIST AI RMF, ISO 42001)
Full description
Our Mission
At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.
Who We Are
In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!
We believe collaboration thrives in person. That’s why most of our teams work from the office full time, with flexibility when it’s needed. This model supports real-time problem-solving, stronger relationships, and the kind of precision that drives great outcomes.
Job Summary
We are seeking a Principal InfoSec GRC Business Engineer to architect, execute, and mature our Global Governance, Risk, and Compliance programs. In this senior role, you will bridge technical security engineering, enterprise risk management, and business operations by designing global governance frameworks and scalable risk assessment methodologies. You will partner with key stakeholders to craft actionable security policies and standards. Leveraging an engineering mindset, you will use AI, automation, and continuous control monitoring to embed security seamlessly into product, platform, and enterprise operations.
Key Responsibilities
- Design and scale the global GRC vision to align security governance with enterprise goals and regulatory mandates.
- Partner with senior leaders across Information Security, Legal, and Product Engineering to align risk tolerance with business objectives.
- Lead the drafting, maintenance, rollout, and annual review of Information Security policies, standards, procedures, and guidelines.
- Translate complex regulatory and security frameworks into clear, actionable security-focused requirements.
- Architect and refine quantitative and qualitative risk assessment methodologies for cloud, SaaS, and hybrid environments.
- Lead end-to-end technical security risk evaluations for business-critical applications, infrastructure, and processes.
- Design and manage executive-level risk reporting to provide visibility into risk posture and drive risk reduction.