Senior GRC Engineer - EMEA

About the role

Isovalent, now part of Cisco, is looking for a senior Security Officer / GRC (Governance, Risk and Compliance) Engineer to support the Hypershield solution. The role provides senior security guidance and hands-on engineering contributions, partnering with Engineering, Architecture, Product Management, SRE, Compliance, Cisco's Security and Trust Organization and leadership teams to meet security, privacy, corporate and regulatory requirements while enabling rapid and secure product delivery.

Key responsibilities

• Assess and guide improvements to the security posture of Hypershield components and delivery workflows
• Translate Cisco security mandates, policies, audit requirements, release gates and best practices into clear guidance, control expectations, acceptance criteria and remediation priorities
• Review new features, architecture changes and security-sensitive designs with development teams, architects, product management, SRE and compliance teams, recommending mitigations
• Support compliance with Cisco security mandates and Build Environment Security requirements by clarifying requirements, gathering evidence and guiding remediation
• Contribute to security and compliance automation, reporting and tooling that improve visibility and reduce manual work

Required profile

• Bachelor's degree and 5+ years of hands-on experience implementing security and compliance automation, hardening, vulnerability remediation or related DevSecOps capabilities
• 3+ years of security reviews, architecture reviews, threat or risk assessments and turning findings into remediation plans (e.g. for SOC2, ISO)
• Experience with corporate security mandates, secure development lifecycle, product security standards and security audits
• Preferred: experience with FedRAMP and other certification frameworks; strong communication skills with technical and non-technical audiences

Required skills

• Security frameworks and compliance audits such as SOC 2, ISO 27001, and data protection standards such as GDPR
• Preferred: Compliance-as-Code, policy-as-code, automated control validation and integration into CI/CD
• Preferred: CISSP, CISM, CCSP or similar certifications