Senior GRC Engineer

Why join us

• Brex is the intelligent finance platform that enables companies to spend smarter and move faster in more than 200 markets.
• By combining global corporate cards and banking with intuitive spend management, bill pay, and travel software, Brex enables founders and finance teams to accelerate operations, gain real-time visibility, and control spend effortlessly.
• Brex's AI-native automation and world-class service eliminate manual expense and accounting tasks for customers so they can focus on what matters most.
• Tens of thousands of the world's best companies run on Brex, including DoorDash, Coinbase, Robinhood, Zoom, Plaid, Reddit, and SeatGeek.
• Working at Brex allows you to push your limits, challenge the status quo, and collaborate with some of the brightest minds in the industry.
• We're committed to building a diverse team and inclusive culture and believe your potential should only be limited by how big you can dream.
• We make this a reality by empowering you with the tools, resources, and support you need to grow your career.

Engineering at Brex

• Engineering at Brex is about building systems that scale with speed and intention.
• Our teams operate with high autonomy and deep collaboration, own outcomes end to end, and push for excellence from architecture to deployment.
• It's an environment where engineering is a craft and builders grow by solving meaningful technical problems.

What you'll do

• As a Senior GRC Engineer at Brex, you'll lead the IT security compliance workstreams that connect our technical control owners to the people who examine our controls: external auditors, Internal Audit, state regulators, and Finance.
• You'll coordinate and test the technical controls behind our financial reporting (SOX/ITGC), our annual SOC 1 Type 2 report, our state money transmitter examinations, and our FINRA IT requirements.
• You'll also run the annual business continuity and disaster recovery (BC/DR) testing calendar.
• As part of the GRC team you may also contribute to the following operational tasks:

• Third party risk management
• Risk register maintenance and reporting
• Customer Trust / GTM due diligence support
• Tooling access requests
• Assist with requests related to other certifications like SOC 2 Type 2, PCI DSS, or ISO 27001

Where you'll work

• This role will be based in our San Francisco office.
• We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home.
• We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday.
• As a perk, we also have up to four weeks per year of fully remote work!

Responsibilities

• Lead IT SOX/ITGC test procedures, walkthroughs, evidence, workpapers, and remediation across logical access, change management, computer operations, and IT governance.
• Manage our annual SOC 1 Type 2 engagement, including external auditor coordination, control descriptions, evidence, deficiency tracking, and review of draft report sections.
• Support state money transmitter (MTL) examinations by working with Legal, Compliance, and Finance on IT documentation, examiner requests, and tracking of IT findings.
• Test quarterly user access reviews, privileged-access evidence, and segregation-of-duties remediation, and verify that in-scope changes are complete and properly authorized.
• Run the annual BC/DR testing calendar, including tabletop and failover exercises, and document results, evidence, and remediation.
• Prepare FINRA-related IT control documentation, including business continuity, books-and-records, systems access reviews, and readiness testing.
• Track findings through to closure with clear control owners, deadlines, and evidence, and keep audit coordination separate from control operation.
• Support broader GRC team operational tasks related to evidence collection, access requests, and risk management.

Requirements

• 5+ years of experience in IT audit, SOX/ITGC testing, GRC, or technology compliance, in fintech, financial services, or public accounting.
• Hands-on experience with ITGC testing across logical access, change management, and computer operations, and with documenting results in audit workpapers.
• Working knowledge of SOC 1 / SSAE 18, including Type 2 reports, control descriptions, and deficiency management.
• Familiarity with PCAOB standards.
• Experience working with external auditors, regulators, or examiners and responding to their requests on deadline.
• Strong organization and project management skills, with the ability to run several audit workstreams on different calendars at once.
• Clear communication, and comfort holding technical control owners accountable for evidence and remediation.

Bonus points

• CISA, CIA, CPA, or CISSP certification.
• Experience with state money transmitter examinations or FINRA IT and books-and-records requirements.
• Experience coordinating BC/DR testing, including tabletop and failover exercises.
• Experience supporting audit readiness during an acquisition or integration.
• Familiarity with COSO 2013 and COBIT.
• Experience with GRC or audit workflow tools, or with SQL or scripting for control testing.

Compensation

• The expected salary range for this role is $153,600 - $192,000.
• However, the starting base pay will depend on a number of factors including the candidate's location, skills, experience, market demands, and internal pay parity.
• Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package.
• Brex LLC is a wholly owned subsidiary of Capital One, N.A.

Please be aware, job-seekers may be at risk of targeting by malicious actors looking for personal data. Brex recruiters will only reach out via LinkedIn or email with a brex.com domain. Any outreach claiming to be from Brex via other sources should be ignored.