Senior GRC Engineer

Your work-authorization answers for this form, ready to paste. Free.

Why join us Brex is the intelligent finance platform that enables companies to spend smarter and move faster in more than 200 markets. By combining global corporate cards and banking with intuitive spend management, bill pay, and travel software, Brex enables founders and finance teams to accelerate operations, gain real-time visibility, and control spend effortlessly. Brex’s AI-native automation and world-class service eliminate manual expense and accounting tasks for customers so they can focus on what matters most. Tens of thousands of the world's best companies run on Brex, including DoorDash, Coinbase, Robinhood, Zoom, Plaid, Reddit, and SeatGeek. Working at Brex allows you to push your limits, challenge the status quo, and collaborate with some of the brightest minds in the industry. We’re committed to building a diverse team and inclusive culture and believe your potential should only be limited by how big you can dream. We make this a reality by empowering you with the tools, resources, and support you need to grow your career. Engineering at Brex Engineering at Brex is about building systems that scale with speed and intention. Our teams operate with high autonomy and deep collaboration, own outcomes end to end, and push for excellence from architecture to deployment. It’s an environment where engineering is a craft and builders grow by solving meaningful technical problems. What you’ll do As a Senior GRC Engineer at Brex, you’ll lead the IT security compliance workstreams that connect our technical control owners to the people who examine our controls: external auditors, Internal Audit, state regulators, and Finance. You’ll coordinate and test the technical controls behind our financial reporting (SOX/ITGC), our annual SOC 1 Type 2 report, our state money transmitter examinations, and our FINRA IT requirements. You’ll also run the annual business continuity and disaster recovery (BC/DR) testing calendar. As part of the GRC team you may also contribute to the following operational tasks: Third party risk management Risk register maintenance and reporting Customer Trust / GTM due diligence support Tooling access requests Assist with requests related to other certifications like SOC 2 Type 2, PCI DSS, or ISO 27001 Where you’ll work This role will be based in our New York City office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work! Responsibilities Lead IT SOX/ITGC test procedures, walkthroughs, evidence, workpapers, and remediation across logical access, change management, computer operations, and IT governance. Manage our annual SOC 1 Type 2 engagement, including external auditor coordination, control descriptions, evidence, deficiency tracking, and review of draft report sections. Support state money transmitter (MTL) examinations by working with Legal, Compliance, and Finance on IT documentation, examiner requests, and tracking of IT findings. Test quarterly user access reviews, privileged-access evidence, and segregation-of-duties remediation, and verify that in-scope changes are complete and properly authorized. Run the annual BC/DR testing calendar, including tabletop and failover exercises, and document results, evidence, and remediation. Prepare FINRA-related IT control documentation, including business continuity, books-and-records, systems access reviews, and readiness testing. Track findings through to closure with clear control owners, deadlines, and evidence, and keep audit coordination separate from control operation. Support broader GRC team operational tasks related to evidence collection, access requests, and risk management. Requirements 5+ years of experience in IT audit, SOX/ITGC testing, GRC, o

Get roles like this in your inbox.