Note: The job is a remote job and is open to candidates in USA. ezCater is a food tech platform that helps workplaces manage food needs and enables restaurants to grow through high-value business orders. The company is seeking a Staff Security Engineer, GRC to lead the maturation of governance, risk, compliance, and data security capabilities through control design, continuous monitoring, automation, AI governance, and cross-functional security program improvements.
Responsibilities
- Design and maintain an auditable control framework that fits ezCater’s SaaS, cloud, data, and engineering environment rather than forcing generic controls onto modern systems
- Shape and define ezCater’s AI Governance strategy with stakeholders across the Legal, Data, Engineering, and IT domains
- Define how key controls are implemented, tested, evidenced, and improved over time, with a strong bias toward reliability and highly-automated, low/no friction evidence paths
- Partner with internal and external audit stakeholders on control design, walkthroughs, exceptions, remediation, and readiness activities tied to SOX and related frameworks
- Help rationalize overlapping control requirements across SOC 2, PCI, SOX, and internal policy expectations into a coherent operating model
- Identify where quarterly or annual checks should become continuous or near-real-time monitoring, especially for high-value controls and failure-prone workflows
- Partner with Security Engineering, IT, Data, and platform teams to automate control testing, evidence collection, validation, and recurring compliance workflows
- Define the logs, metadata, dashboards, and signals needed to assess control health and make compliance more observable and less dependent on screenshots and one-off pulls
- Help shift the program from detective-only controls toward stronger preventive and engineering-embedded control patterns where appropriate
- Help define and mature data security policies, standards, and handling requirements so they are clear, enforceable, and tied to actual technical and operational practices
- Partner with Data, Engineering, and business stakeholders to ensure data governance shows up in meaningful places such as access patterns, role design, labels, masking, retention, and evidence paths
- Establish what a high-quality GRC program looks like by helping define operating cadences, ownership models, decision paths, metrics, and continuous improvement loops
- Drive clearer documentation, standards, and guidance that both technical teams and auditors can use effectively
- Support day-to-day GRC and assurance work where hands-on execution is needed to keep the program moving, including control failures, remediation coordination, audit operations, and related follow-through
- Improve the team’s ability to handle questionnaires, trust requests, vendor and partner reviews, and other recurring work through better structure, reusable materials, and smarter agentic workflows
- Act as a practical partner to teams implementing or remediating controls, not just an assessor of whether the control exists on paper
- Own a domain with high autonomy, lead cross-team efforts from start to finish, and improve the quality of systems, controls, and processes across that domain
- Drive alignment across stakeholders with different incentives and constraints, making pragmatic decisions that balance risk, cost, and operational reality
- Mentor others, improve documentation and knowledge sharing, and help raise the overall maturity of the Security Engineering & Compliance team and its partners
Skills
- • 8+ experience in security GRC, compliance, risk, or security program work in a SaaS or cloud-native environment, including meaningful ownership of control design, testing, and program improvement
- • Strong experience with security compliance frameworks such as ISO-27001, NIST CSF, SOC 2, ITGC, and PCI-DSS, including how to translate framework requirements into controls that work in real systems and teams
- • Demonstrated ability to automate or instrument parts of a compliance or assurance program through scripting, APIs, dashboards, platform configuration, or other technical approaches
- • Implementation of engineering system guardrails for ensuring compliance utilizing Policy-as-Code (Terraform) or secure configurations of platform systems within cloud hosted environments (AWS, GitHub, etc.)
- • Experience building or improving data security governance, classification, handling rules, or related control practices across business systems, data platforms, or collaboration environments
- • Familiarity with governing and securing AI/Agentic systems and business processing
- • Strong written communication and cross-functional influence skills, with the ability to explain controls, trade-offs, and program expectations to both technical and non-technical audiences
- • Able to collaborate closely with engineers and technical teams to design controls as code, configuration, workflow, or monitoring instead of relying only on policy documents and manual checklists
- • Strong systems thinker who can break ambiguous governance problems into workable operating models, measurable outcomes, and implementation steps
- • Comfortable balancing strategic design work with operational execution when the program needs direct hands-on support
- • Someone who improves process quality, identifies gaps between teams, and drives implementation of better ways of working
- • Comfortable leveraging AI tooling and automated workflows to increase scale and velocity
- EzCater does not sponsor applicants for work visas or legal permanent residence
- • Experience with scaling a unified control framework across multiple governance and compliance frameworks
- • Experience with continuous control monitoring, policy-as-code, or GRC platforms and evidence tooling
- • Familiarity with AI governance or emerging technology risk, especially where governance needs to be translated into practical technical guardrails
Benefits
- Stock options
- 12 paid holidays
- Flexible PTO
- 401K with ezCater match
- Health/dental/FSA
- Long-term disability insurance
- Mental health and family planning resources
- Remote-hybrid work from our awesome Boston office OR your home OR a mixture of both home and office
- Opportunities to grow in your career
- A tremendous amount of responsibility and autonomy
- Employee meal program when you’re in our office
Company Overview