CloudflareUnited StatesGRC Engineer building automated compliance solutions, AI governance frameworks, and audit-ready infrastructure at Cloudflare. Requires 5+ years experience, IaC/PaC expertise (Terraform, OPA), Python/Go scripting, and full-stack web development skills.
Automation & Engineering: Develop and implement automated solutions to improve GRC processes and operations, integrating with existing security, engineering, and AI tools. Build modules and maintain our GRC platform and other similar initiatives.
AI Governance: Architect and maintain a technical governance framework for the safe deployment of autonomous AI agents. Ensure that agentic workflows operate within deterministic "action gates" and predefined risk thresholds.
Audit & Infrastructure: Support Cloudflare’s security assessments (e.g., SOC 2, ISO 27001, PCI DSS, FedRAMP). Treat "Audit Readiness" as a product, ensuring our global edge network remains compliant through automated drift detection and self-healing configurations.
Security Integration: Work cross-functionally with Legal, People, Engineering, and Finance teams to integrate security into the fabric of the company, moving away from "gatekeeping" toward a paved-road security model where compliance is the default state for every developer.
This role is eligible to participate in Cloudflare’s equity plan.
Cloudflare offers a complete package of benefits and programs to support you and your family, including medical, dental, and vision insurance, a 401(k) plan with company match, flexible paid time off, and fertility & family-forming benefits.
Own end-to-end compliance programs (SOC 2, HIPAA, HITRUST), build customer trust function, implement automation, and partner with engineering on controls for a healthcare AI platform handling protected health information.
Safeguards Enforcement Analyst focused on account takeover and credential abuse. Investigate compromise incidents, design remediation workflows, partner with engineering on detection, enforce AI usage policies, and develop scalable enforcement programs for platform safety.
Application Security Engineer partnering with engineering teams to embed security into the SDLC, triage SAST/SCA findings, provide remediation guidance on OWASP issues, maintain security docs/playbooks, support governance/audits, and integrate GenAI tools while building AI governance guardrails.
Security Detections Engineer identifying attacker TTPs, building real-time detections, and mitigating threats/abuse across Cloudflare's global platform using data analysis, SQL, scripting, and threat intelligence. Requires strong analytical and communication skills.
Own and run Mintlify's end-to-end security and compliance programs (SOC 2, ISO 27001/42001, GDPR, Microsoft SSPA) as the first dedicated GRC Program Manager. Administer Drata, manage audits/vendors/evidence, handle customer-facing compliance, and coordinate with engineering.