Senior Security Engineer (GRC)

About the role

In this role, you will develop and enforce security policies across the organization, ensuring compliance with regulatory frameworks and readiness for audits. You will work closely with various teams to align security measures with business objectives while promoting a culture of shared risk responsibility.

Offchain Labs is focused on pioneering blockchain technology, and this position is integral to their mission of enhancing security and governance. Success in this role involves clear communication of security standards and effective collaboration with both technical and non-technical stakeholders.

The salary range for this role is between $112,000 and $188,000, depending on experience.

Skills that matter here

• NIST CSF: You will utilize NIST CSF to establish security policies and ensure compliance.
• AWS: Experience with AWS is crucial for managing cloud security and compliance.
• Regulatory frameworks: You will need to navigate and implement major regulatory frameworks like SOC2 and ISO 27001.
• Risk management: This role requires strong skills in risk management to assess and mitigate potential security threats.
• Security engineering: Your expertise in security engineering will help shape the company's overall information security governance program.
• Communication skills: You will need to effectively communicate complex security concepts to diverse audiences.

Who this role suits

• You have a strong background in security engineering or risk management, with over five years of relevant experience.
• You thrive in collaborative environments and enjoy working with cross-functional teams.
• You are adept at translating complex technical details into clear, actionable processes.
• You are proactive in promoting security awareness and building a culture of shared responsibility.

From the employer

What you'll do:

• Develop and enforce security policies, standards, and procedures organization-wide.
• Ensure the company is audit-ready and responsive to any regulatory changes.
• Establish and clearly communicate data privacy and data-handling standards to internal teams as well as external partners and stakeholders.
• Track, document, and report on the status of security controls, ongoing audits, and all related compliance activities.
• Play an active part in designing, launching, and continuously refining the company’s overall information security governance program.
• Work closely with security, engineering, infrastructure, and product teams to make sure controls fit both business objectives and technical realities.
• Promote security awareness and build a strong culture of shared risk responsibility through focused training and straightforward communication.
• Support both internal and external audits by coordinating evidence gathering, preparing materials, and ensuring findings are addressed quickly and thoroughly.

What you'll need:

• 5+ years of experience in a security engineering, governance, or risk management role.
• Solid understanding of AWS or other cloud vendors.
• Strong understanding of core information security concepts and major regulatory frameworks/standards (e.g. SOC2, ISO 27001, NIST CSF).
• Hands-on experience with standard risk assessment approaches and supporting tools.
• Direct experience drafting and updating security policies.
• Ability to translate complex regulatory and technical obligations into straightforward, actionable internal processes.
• Strong communication skills that work well with both technical and non-technical audiences.
• Excellent written and verbal communication skills, with the ability to present complex technical details as clear, risk-focused recommendations.

Perks:

• Remote-first global workforce + NY office.
• Annual company offsite + team onsites.
• Professional reimbursement program (facilitates industry conference attendance, certifications, and more).
• Medical, dental & vision coverage (US + some other countries).
• 401k retirement plan + company match (US only).
• Wellness stipend.
• Home office set up / ergonomic equipment program.