GRC Engineer

We’re building the AI-driven future of customer success, from retention to growth!

We’re building the AI-driven future of customer success, from retention to growth! Gainsight is the AI-powered retention engine behind the world’s most customer-centric companies. The Gainsight CustomerOS platform orchestrates the customer journey from onboarding to outcomes to advocacy. More than 2,000 companies trust Gainsight’s applications and AI agents to drive learning, adoption, community connection, and success for their customers. To explore how our suite of solutions is shaping the future of customer success, check out the link.

About This Role:

We’re looking for a full-time GRC Engineer to join our Security team reporting to the Director of Security. This role is a remote role based in Mexico.

In this role, you'll play a key role in maintaining Gainsight's governance, risk, and compliance program and keeping the company audit-ready by maintaining control frameworks, supporting internal and external audits, assessing third-party risk, and automating evidence collection. This is a great opportunity for someone who thrives in a detail-oriented, SaaS and cloud-based environment and enjoys working cross-functionally with teams like Security, Engineering, IT, and Legal. The ideal candidate brings strong skills in GRC frameworks (SOC 2, ISO 27001, NIST), audit and risk management, and clear communication.

What You'll Do:

• Maintain multiple control frameworks and map controls to standards

• Track control ownership and health

• Meet with control owners to address gaps in controls

• Scope audits for both internal and external audits

• Work with auditors through the audit process from kick-off to completion

• Collect and review evidence for all frameworks to ensure compliance and traceability

• Track audit findings and remediations to completion

• Perform security reviews of all Third-Parties and Vendors

• Track vendor remediation items and maintain the vendor inventory

• Draft, update, and maintain all security policies, procedures, and standards regularly

• Answer customer security questionnaires and requests

• Support customer audits and provide compliance documentation where required

• Manage the risk register including exceptions, acceptance, expiry

• Build and maintain integrations and automation for evidence collection and control monitoring

• Work with engineering teams to align technical controls to business requirements

This role may require occasional travel (up to 10-25%) for team meetings, training, or company events. This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business.

What We're Looking For:

• 5+ years of experience in GRC, security compliance, IT audit, or risk management, ideally within a SaaS or cloud-based company.

• Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, and NIST, including how to map controls across them.

• Experience supporting external audits and assessments, including scoping, evidence collection, walkthroughs, and tracking findings through remediation.

• Experience performing risk assessments, maintaining a risk register, and reviewing the security posture of third-party vendors.

• Familiarity with compliance automation or GRC tools, and experience implementing security automation, such as scripting or workflow tools that automate recurring evidence collection and control monitoring.

• Understanding of cloud infrastructure and common security controls (access management, logging, encryption, change management) sufficient to evaluate evidence and discuss it with engineers.

• Clear written and verbal communication, with the ability to explain control requirements and risk to technical and non-technical teams and to manage several deadlines at once.

Nice-to-have skills or experience:

• Experience with AI Governance frameworks.

• Previous experience with highly regulated industries that require HIPAA or FedRamp.

• Experience working with globally distributed teams.

• Security certifications such as CISA, CRISC, or Security+ certifications.

Why You’ll Love It Here:

Gainsight is a place where innovation is shaped through collaboration, curiosity, and a shared focus on solving real-world problems. With a growing suite of products across customer success, product experience, community, education, and AI-powered relationship intelligence, we continue to evolve with the needs of our customers. When people with diverse strengths, a strong sense of community, and true passion for our mission come together, they drive greater impact and create lasting value. What underpins it all is a culture that offers the stability, trust, and support that people need - not just to do the job, but to show up as themselves and feel connected to the work they do. Gainsters love working here for several reasons. Here are a few:

Our benefits: We offer a comprehensive benefits package including a corporate performance bonus and a Christmas bonus (Aguinaldo) per local requirements. Benefits are administered through Remote, including medical, dental, vision, and other local statutory benefits.

Our Core Values: We are guided by our values and our mission to be living proof you can win in business while being Human-First. Learn more here.

Our Growth Opportunities: From mentoring to career development opportunities, we’re passionate about helping our teammates learn, grow, and thrive.

Our Parody Videos: No explanation needed. Just watch them here!

If this sounds like the right role for you, we’d love to hear from you.

Additional Information:

We’re committed to creating an inclusive, fair, and transparent hiring process. As an equal opportunity employer, we celebrate diversity and are committed to creating a welcoming experience for all candidates.

If you require accommodations or have questions about how your personal data will be used during the hiring process, please contact [email protected].

If you’re applying for a role through an Employer of Record (EOR) or contractor arrangement, please note that employment terms and benefits are managed by the EOR or may not apply to non-EOR contractors.