We’re building the AI-driven future of customer success, from retention to growth!
We’re building the AI-driven future of customer success, from retention to growth! Gainsight is the AI-powered retention engine behind the world’s most customer-centric companies. The Gainsight CustomerOS platform orchestrates the customer journey from onboarding to outcomes to advocacy. More than 2,000 companies trust Gainsight’s applications and AI agents to drive learning, adoption, community connection, and success for their customers. To explore how our suite of solutions is shaping the future of customer success, check out the link.
About This Role:
We’re looking for a full-time GRC Engineer to join our Security team reporting to the Director of Security. This role is a remote role based in Mexico.
In this role, you'll play a key role in maintaining Gainsight's governance, risk, and compliance program and keeping the company audit-ready by maintaining control frameworks, supporting internal and external audits, assessing third-party risk, and automating evidence collection. This is a great opportunity for someone who thrives in a detail-oriented, SaaS and cloud-based environment and enjoys working cross-functionally with teams like Security, Engineering, IT, and Legal. The ideal candidate brings strong skills in GRC frameworks (SOC 2, ISO 27001, NIST), audit and risk management, and clear communication.
What You'll Do:
Maintain multiple control frameworks and map controls to standards
Track control ownership and health
Meet with control owners to address gaps in controls
Scope audits for both internal and external audits
Work with auditors through the audit process from kick-off to completion
Collect and review evidence for all frameworks to ensure compliance and traceability
Track audit findings and remediations to completion
Perform security reviews of all Third-Parties and Vendors
Track vendor remediation items and maintain the vendor inventory
Draft, update, and maintain all security policies, procedures, and standards regularly
Answer customer security questionnaires and requests
Support customer audits and provide compliance documentation where required
Manage the risk register including exceptions, acceptance, expiry
Build and maintain integrations and automation for evidence collection and control monitoring
Work with engineering teams to align technical controls to business requirements
This role may require occasional travel (up to 10-25%) for team meetings, training, or company events. This is not a complete list of responsibilities, and the scope of the role may evolve with the needs of the team and business.
What We're Looking For:
5+ years of experience in GRC, security compliance, IT audit, or risk management, ideally within a SaaS or cloud-based company.
Working knowledge of security and compliance frameworks such as SOC 2, ISO 27001, and NIST, including how to map controls across them.
Experience supporting external audits and assessments, including scoping, evidence collection, walkthroughs, and tracking findings through remediation.
Experience performing risk assessments, maintaining a risk register, and reviewing the security posture of third-party vendors.
Familiarity with compliance automation or GRC tools, and experience implementing security automation, such as scripting or workflow tools that automate recurring evidence collection and control monitoring.
Understanding of cloud infrastructure and common security controls (access management, logging, encryption, change management) sufficient to evaluate evidence and discuss it with engineers.
Clear written and verbal communication, with the ability to explain control requirements and risk to technical and non-technical teams and to manage several deadlines at once.
Nice-to-have skills or experience:
Experience with AI Governance frameworks.
Previous experience with highly regulated industries that require HIPAA or FedRamp.
Experience working with globally distributed teams.
Security certifications such as CISA, CRISC, or Security+ certifications.