Staff GRC Engineer

ezCater is the #1 food tech platform for workplaces in the US. The company makes it easy for any organization to manage its food needs and order from over 125,000 restaurants nationwide. For workplaces, ezCater provides flexible and scalable solutions for everything from employee meal programs to one-off meetings, all backed by beyond helpful 24/7 service and business-grade reliability. For restaurant partners, ezCater helps grow their business by bringing them new high-value customers and large orders.ezCater is looking for a Staff GRC Engineer to join the Security Engineering & Compliance team as a senior individual contributor who can help mature our governance, risk, compliance, and data security capabilities in a way that is durable, measurable, and embedded into how our systems operate day to day. This is not a narrow audit coordinator or policy only role. We’re looking for a balanced builder-operator who can raise the quality and maturity of our security controls by expanding control monitoring, strengthening data security governance, automating and instrumenting the program where stronger evidence and better monitoring are needed, and improving the operational follow through that makes the program scalable, sustainable, and effective.What You'll Do:Lead control program maturityDesign and maintain an auditable control framework that fits ezCater’s SaaS, cloud, data, and engineering environment rather than forcing generic controls onto modern systems.Shape and define ezCater’s AI Governance strategy with stakeholders across the Legal, Data, Engineering, and IT domains. Define how key controls are implemented, tested, evidenced, and improved over time, with a strong bias toward reliability and highly-automated, low/no friction evidence paths.Partner with internal and external audit stakeholders on control design, walkthroughs, exceptions, remediation, and readiness activities tied to SOX and related frameworks.Help rationalize overlapping control requirements across SOC 2, PCI, SOX, and internal policy expectations into a coherent operating model.Build continuous control monitoring and automationIdentify where quarterly or annual checks should become continuous or near-real-time monitoring, especially for high-value controls and failure-prone workflows.Partner with Security Engineering, IT, Data, and platform teams to automate control testing, evidence collection, validation, and recurring compliance workflows.Define the logs, metadata, dashboards, and signals needed to assess control health and make compliance more observable and less dependent on screenshots and one-off pulls.Help shift the program from detective-only controls toward stronger preventive and engineering-embedded control patterns where appropriate.Expand data security policy and program qualityHelp define and mature data security policies, standards, and handling requirements so they are clear, enforceable, and tied to actual technical and operational practices.Partner with Data, Engineering, and business stakeholders to ensure data governance shows up in meaningful places such as access patterns, role design, labels, masking, retention, and evidence paths.Establish what a high-quality GRC program looks like by helping define operating cadences, ownership models, decision paths, metrics, and continuous improvement loops.Drive clearer documentation, standards, and guidance that both technical teams and auditors can use effectively.Drive operational quality improvementsSupport day-to-day GRC and assurance work where hands-on execution is needed to keep the program moving, including control failures, remediation coordination, audit operations, and related follow-through.Improve the team’s ability to handle questionnaires, trust requests, vendor and partner reviews, and other recurring work through better structure, reusable materials, and smarter agentic workflows.Act as a practical partner to teams implementing or remediating controls, not just an assessor of whether the control exists on paper.Lead through influence and systems thinkingOwn a domain with high autonomy, lead cross-team efforts from start to finish, and improve the quality of systems, controls, and processes across that domain.Drive alignment across stakeholders with different incentives and constraints, making pragmatic decisions that balance risk, cost, and operational reality.Mentor others, improve documentation and knowledge sharing, and help raise the overall maturity of the Security Engineering & Compliance team and its partners.What You Have:8+ experience in security GRC, compliance, risk, or security program work in a SaaS or cloud-native environment, including meaningful ownership of control design, testing, and program improvement.Strong experience with security compliance frameworks such as ISO-27001, NIST CSF, SOC 2, ITGC, and PCI-DSS, including how to translate framework requirements into controls that work in real systems and teams.Demonstrated ability to aut