Senior Security Engineer - GRC
Senior GRC engineer at Playlist (ClassPass/Mindbody) who owns the technical control architecture: building a Master Control List mapped across PCI DSS, SOC 1, ISO 27001, HITRUST, and NIST, automating evidence collection in GRC tooling, and building AI/agent pipelines for risk quantification and compliance monitoring.
- Compensation
- $150K–$170K / yr
- Location
- United States
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 6+ years
- Category
- Security
- Posted
Skills
Must have
- 6+ years of experience in security engineering, GRC, or compliance engineering, with direct hands-on work across multiple regulatory frameworks
- Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53
- Experience designing or maintaining control frameworks, crosswalks, or unified control architectures across multiple compliance standards
- Hands-on experience managing evidence requirements and control implementation, not just documentation
- Proficiency with compliance automation tooling (Optro, Drata, Vanta, Hyperproof, Anecdotes, or similar)
- Ability to translate technical control design into clear implementation guidance for engineering and product teams
- Experience building or operating agentic AI workflows (LLM-based pipelines, multi-agent systems, RAG architectures) in a production or near-production context
Nice to have
- Hands-on experience with AWS services (Lambda, Step Functions, EventBridge, S3, Aurora/RDS) for compliance automation infrastructure
- Experience supporting external audits or assessments as a primary technical contact
- Exposure to multi-brand or post-acquisition control harmonization
- Certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP (HITRUST), or PCI ISA
- Experience in a SaaS or consumer marketplace environment
Full description
At Playlist, life's richest moments happen when people step away from screens to move, connect, explore, and play. We're building the definitive platform for intentional living, connecting people with inspiring experiences in fitness, wellness, and beyond. With popular brands like Mindbody and ClassPass, Playlist empowers businesses and individuals, making it effortless for aspirations to become actions. Join us in reshaping technology's role to foster meaningful, real-world connections.
ClassPass offers thousands of fitness and wellness experiences worldwide, helping people lead active, balanced lifestyles. Our platform makes discovering and enjoying activities simple, personalized, and joyful—whether it's fitness classes, self-care sessions, a healthy lunch, or a new adventure. Join us in shaping healthier, more vibrant communities around the globe.
Who we are
The GRC team at Playlist owns governance, risk, third-party risk, and compliance across a portfolio that spans Mindbody, ClassPass, Booker, Kite, and EGYM, with more brands coming as the company grows. We operate without a playbook, building programs, frameworks, and control architecture in an environment that's complex, not just big. The team works closely with Engineering, Legal, Finance, and product teams to make compliance real rather than ceremonial. If you want to do meaningful work on hard problems with people who take both rigor and pragmatism seriously, we'd love to meet you.
Your role
As a Senior GRC Engineer, you'll own the technical spine of how Playlist manages its control environment. That means designing the architecture that lets the team work across multiple compliance frameworks without duplicating effort at every audit, and making sure control design, evidence requirements, and implementation keep pace with regulatory change and business growth.
You'll be expected to act as a technical leader who can help mature our governance, risk, compliance, in a way that is durable, measurable, and embedded into how our systems operate day to day. Your time will center on two related workstreams. The first is building and maintaining Playlist's Master Control List, a live control architecture mapped across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53 that teams can use and navigate. The second is managing the full lifecycle of controls and evidence requirements as new standards are adopted, updated, or expanded to cover newly acquired brands.
You will
- Design and build framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53, using languages such as OSCAL as the translation layer to preserve framework-specific requirements while reducing duplicate audit burden
- Own the Master Control List end-to-end, including control nomenclature, relational database architecture, evidence linkages, and the operational model for ongoing maintenance across Playlist's multi-brand footprint