GRC Engineer (Governance Risk and Compliance)

Position Summary:

Coterie's GRC team is seeking a GRC Engineer to help build, test, and improve how we manage and validate security, technology, and compliance controls. This hands-on technical role focuses on continuous control monitoring, application and technology control testing, risk evaluation, and the collection and validation of audit evidence directly from source systems.

The ideal candidate combines a strong understanding of risk and controls with the technical ability to work directly with systems and data. You will build and perform control testing, identify control and process gaps, assess associated risk, and recommend practical remediation or compensating controls. You will also support broader GRC initiatives, including risk management, BC/DR, privacy, and other program priorities as needed.

Key Responsibilities:

Control Monitoring & Testing

• Build and maintain repeatable testing and monitoring processes for security, technology, and application controls.
• Define how controls will be tested, including testing procedures, evidence requirements, frequency, expected results, and exception criteria.
• Perform control testing to assess design and operating effectiveness and document testing procedures, results, and conclusions.
• Identify control failures, process gaps, control drift, and evidence deficiencies, and assess the related risk and compliance impact.
• Investigate the cause of identified deficiencies and work with control owners to develop practical remediation or compensating controls.
• Design and implement practical solutions to automate evidence collection, control testing, and continuous monitoring using queries, scripts, APIs, integrations, and GRC tooling where appropriate.

Technical Evidence & Audit Support

• Retrieve evidence directly from applications and source systems on behalf of control owners for audits, assessments, and control testing.
• Build and document repeatable procedures for collecting and validating technical evidence, including system reports, configurations, access data, logs, vulnerability results, and change records.
• Validate the completeness, accuracy, scope, and reliability of system-generated evidence and data used for testing and audits.
• Support SOC 2, ITGC/SOX readiness, NYDFS, and other audit and compliance activities, including walkthroughs, evidence requests, testing, and auditor follow-up.
• Maintain organized, audit-ready evidence and testing documentation and retest remediated controls as needed.

Risk & Control Advisory

• Assess the effectiveness of security and technology controls in mitigating their associated risks.
• Translate regulatory, audit, and security requirements into practical control requirements and testing procedures.
• Identify control and process gaps, assess the associated risk, and recommend control improvements, compensating controls, or other risk treatment options.
• Support technical risk assessments, remediation planning, and other risk management activities.

GRC Program Support

• Support GRC initiatives across risk management, business continuity and disaster recovery, privacy, third-party risk management, governance, and regulatory compliance.
• Identify and implement opportunities to use automation, AI, and other technologies to improve GRC processes while maintaining appropriate security, privacy, data handling, and human oversight.
• Build and document processes, procedures, testing approaches, and supporting materials as GRC programs mature.
• Partner with business and technical teams on assessments, remediation efforts, and other GRC priorities as assigned.

Required Qualifications:

• 4+ years of relevant experience in IT audit, GRC, information security, security assurance, technology risk, or related disciplines.
• Hands-on experience testing technical security and technology controls and supporting audits or assessments such as SOC 2, SOX/ITGC, ISO 27001, NYDFS, NIST, or similar.
• Strong understanding of security control domains, including identity and access management, logging and monitoring, vulnerability and endpoint management, cloud security, change management, SDLC, and backup and recovery.
• Ability to independently retrieve, interpret, and validate technical evidence, including system configurations, access data, logs, vulnerability results, change records, and system-generated reports, including assessing completeness and accuracy.
• Working knowledge of SQL, KQL, PowerShell, or similar tools for querying, analyzing, and validating system data used in control testing. Software engineering experience is not required.
• Ability to evaluate control design and operation, understand the underlying risk, identify deficiencies and root causes, and recommend practical remediation or compensating controls.
• Strong analytical, communication, and professional judgment skills, with the ability to work independently and effectively with technical teams, auditors, control owners, and other stakeholders.

Preferred Qualifications (Bonus Experience):

• Experience with Azure, Entra ID, Microsoft 365, SIEM/SOAR, endpoint, vulnerability management, or other cloud and security tooling.
• Experience with continuous control monitoring, automated evidence collection, APIs, scripting, or integrations.
• Experience with GRC/IRM platforms such as Optro/AuditBoard, or similar.
• Experience in insurance, financial services, fintech, or another regulated industry, with familiarity with requirements such as NYDFS 23 NYCRR Part 500, NAIC, PCI DSS, or NIST CSF.
• CISA, CRISC, CISSP, CISM, Security+, or similar certification.

Our interview process:

Our hiring process generally consists of 4 phases. The goal is to provide an opportunity for us to learn more about our candidates while allowing them to get to know us as well!

• Phase 1: Qualified candidates will first meet with a member of our People Operations team for a phone interview.  This discussion is a high-level conversation to understand more about your background and interests and for us to share more about Coterie and the position.
• Phase 2: Selected candidates will be invited to meet with our Hiring Manager for a 2nd interview via Teams video. This interview is designed to be more detail oriented and allows you to learn more about the role and expected to be 30 minutes in length.
• Phase 3: Top candidates will be invited to the next interview round, which will include an experiential exercise project provided in advance, followed by a 1-hour project deep-dive interview with the hiring manager and additional team members, as well as 1:1 interviews with selected team members. This series is expected to be approximately 2 hours in total and can be scheduled over a few days for flexibility.
• Phase 4: Final candidates will be invited to a 30-minute final interview with a member of our senior leadership team.

What's in it for you:

Coterie has excellent benefits for all full-time employees. We offer the following:

• 100% remote
• Health insurance through Aetna (we pay 100% of premiums)
• Dental and vision insurance through Guardian (we pay 100% of premiums)
• Basic life insurance (we pay 100% of premiums)
• Access to flexible spending account (FSA) or health savings account (HSA) (for those using HSA eligible plans)
• 401K plan (up 4% match with immediate vest). Must be 21 years of age or older to participate
• Flexible PTO policy offering employees up to 4 weeks of PTO in their first 12 months. Thereafter, PTO usage aligns with company standards and typically does not exceed 5 weeks per calendar year.
• 12 company-paid holidays each year
• Continuing education annual stipend
• Annual salary estimated between $115,000-$140,000 based on national data. Candidates who meet all the minimum requirements and possess additional relevant experience, as outlined in the job description, may be considered for a salary above the midpoint of the above range. Salary is based on internal equity; internal salary ranges; market data/ranges; applicant’s skills; prior relevant experience; degrees or certifications, etc. 

Work Authorization:
At this time, Coterie Insurance is unable to consider candidates who require current or future visa sponsorship. Applicants must have authorization to work in the United States without the need for sponsorship now or in the future. Falsification of an application, including work authorization status, is immediate grounds for dismissal from consideration.