We are looking for a GRC Engineer to join our team At Qubika, we design, develop, and deploy custom software solutions for organizations making an impact through technology. About the opportunity: The team is building toward ISO 27001 certification and SOC 2 reports using Drata as its compliance automation platform, alongside SOX ITGC obligations. This is a hands-on engineering role: you'll turn frameworks into running controls by automating evidence collection, integrating Drata with the systems that produce evidence, and building reporting that holds up with auditors and leadership. The compliance program is still being built, so you'll set things up as well as run them.

What you'll do
• Drive ISO 27001 (Stage 1 & 2) and SOC 2 (Type I & II) readiness and act as primary auditor liaison
• Maintain a unified control framework across ISO 27001, SOC 2, SOX ITGC, NIST CSF 2.0 and NIST SP 800-53
• Administer Drata and integrate it with Entra ID, AWS, Azure, Jira, Microsoft Sentinel and other evidence sources
• Build scripts and compliance-as-code checks (Python, PowerShell, REST APIs)
• Stand up the cyber risk program and risk register
• Run third-party risk management and the policy lifecycle
• Deliver compliance and risk metrics to leadership What we're looking for:
• 6+ years in security GRC, compliance engineering or IT audit, including 2+ years of hands-on technical work (automation, integrations, scripting)
• ISO 27001:2022 operated through a certification or surveillance audit
• SOC 2 audit experience with Type II evidence
• Working knowledge of SOX ITGCs at a publicly traded company




• NIST CSF 2.0 / NIST SP 800-53 and cross-framework control mapping
• Risk assessment with a recognized methodology and third-party risk experience
• Hands-on administration of Drata or similar (Vanta, Secureframe, ServiceNow IRM, AuditBoard, Archer)
• Scripting in Python or PowerShell and REST APIs
• Solid IAM, cloud security (AWS, Azure) and change management fundamentals
• Strong written communication for engineers, auditors and executives
• Practical, critical use of AI tools (Claude, ChatGPT, Copilot or similar) Nice to have:
• ISO 27001 LI/LA, CISA, CRISC, CISM, CISSP or CCSP
• Experience in energy, critical infrastructure, data centers or digital assets
• OT/ICS frameworks or NERC CIP
• Policy-as-code tooling (OPA/Rego, AWS Config, Azure Policy, Terraform/IaC scanning)

What we offer
• Exciting and innovative projects for disruptive start-ups and world-class companies.
• A creative working environment with a positive and collaborative atmosphere within an open-minded community.
• A senior team that offers mentorship opportunities to help you excel in your career.
• Various benefits include flexible work hours, ongoing skill development, language lessons, travel opportunities, engaging activities, expert talks, and more. This job opening includes people registered in the National Registry for Persons with Disabilities (Registro Nacional de Personas con Discapacidad
- Ley N° 19.691) who meet the conditions and suitability for the position. If you require any accommodations during the application process, please reach out to us at [email protected].

📌 GRC Engineer (Modena)
🏢 Qubika
📍 Modena