Security GRC Engineer

About the role

About Eudia:

Eudia is redefining the future of legal work with AI-powered Augmented Intelligence, enabling Fortune 500 legal teams to move faster, manage risk more effectively, and unlock new business value. Backed by $105M in Series A funding led by General Catalyst, we’re building a category-defining platform that blends AI-driven automation with human expertise, transforming legal from a cost center into a strategic growth driver.

At Eudia, we move fast. Unlike traditional enterprise software, our teams ship solutions in days, not months—delivering real impact for some of the world’s largest companies, including Cargill, Coherent, DHL, and Duracell. We’re solving one of the most complex, unsolved challenges in AI: bringing trust, accuracy, and security to legal automation.

We’re a team of builders, operators, and problem-solvers who are passionate about reshaping an industry that has long been resistant to change. If you’re looking for a place where you’ll be challenged, take ownership from day one, and work alongside some of the brightest minds in AI and legal —we’d love to meet you.

The Role We are hiring a Security GRC Engineer to build and scale the technical backbone of our security and compliance program. This is not a traditional compliance seat. You will take a control requirement, trace it into the system that implements it, work with Engineering to get it right, and automate the evidence that proves it works.

You will operate across SOC 2, ISO 27001, HIPAA, and AI governance, and you will partner with our ISSM on public-sector and FedRAMP-related work rather than owning it. You will own real systems and processes, not just documents, and you will have real room to decide how the program gets built.

We are small and lean, so we value a bias to action. A working control that ships beats a perfect policy that does not.

What You’ll Do

- Translate requirements from SOC 2, ISO 27001, HIPAA, and customer security assessments into concrete technical and operational controls, then validate that those controls actually work.

- Automate evidence collection and control testing wherever it is practical, so audit readiness is a continuous state rather than an annual scramble.

- Drive audit readiness and work directly with auditors and assessors to produce evidence, resolve questions, and remediate findings.

- Own control mappings, risks, findings, exceptions, and remediation tracking as one coherent system across frameworks.

- Partner directly with Engineering, Infrastructure, IT, and Product to design controls that fit how Eudia actually builds and ships software.

- Support security reviews, due diligence, and the customer trust program for large enterprise customers, including security questionnaires and control documentation.

- Work with vulnerability management to prioritize findings by severity, exploitability, reachability, and business impact, and drive them to closure.