What you will be doingPRINCIPAL DUTIES & RESPONSIBILITIES
Are you energized by the challenge of turning cybersecurity requirements into practical, measurable, and automated controls? We are looking for a Cybersecurity GRC Engineer who can bridge the gap between governance, risk, compliance, and technical security operations in a mission-driven healthcare environment.This role is ideal for someone who understands both the language of security frameworks and the realities of modern technical infrastructure. You will help design, implement, validate, and continuously improve security controls across systems, applications, cloud platforms, vendors, and enterprise technologies. You will work closely with cybersecurity engineers, analysts, architects, IT teams, compliance partners, privacy stakeholders, and auditors to strengthen Hospital for Special Surgery's cybersecurity posture through risk-based, evidence-driven, and automation-enabled practices.
The Cybersecurity GRC Engineer will play a key role in advancing continuous compliance, improving audit readiness, supporting risk assessments, and developing repeatable methods for validating security controls. This position requires technical curiosity, sound judgment, strong documentation skills, and the ability to translate regulatory and framework requirements into actionable engineering outcomes.
Position Activities- Translate cybersecurity, privacy, regulatory, and framework requirements into technical control objectives, validation procedures, and measurable security outcomes.
- Design, implement, and maintain automated workflows for security control testing, evidence collection, compliance monitoring, and audit readiness.
- Develop and support policy-as-code, configuration checks, compliance dashboards, and repeatable validation methods to reduce manual assessment activities.
- Perform technical risk assessments and gap analyses for new and existing technologies, systems, applications, cloud services, vendors, and business processes.
- Partner with cybersecurity engineering, infrastructure, application, cloud, and networking teams to evaluate whether technical controls are implemented effectively and operating as intended.
- Collaborate with IT and engineering teams to embed secure-by-design and data-by-default protection principles into applications, services, and infrastructure, while staying current on modern attack techniques and translating that knowledge into code and tooling.
- Review operating systems, applications, cloud resources, network devices, security platforms, and third-party technologies against organizational policies, standards, and secure configuration baselines.
- Correlate vulnerability findings, control gaps, compliance obligations, and business impact to support risk-based remediation prioritization.
- Document control evidence, risk decisions, remediation plans, exceptions, and audit artifacts in a structured, accurate, and repeatable format.
- Collaborate with internal stakeholders, external auditors, and compliance partners to support audits, assessments, regulatory inquiries, and control validation requests.
- Develop metrics, reports, diagrams, and presentations that communicate cybersecurity risk, compliance posture, control effectiveness, and remediation status to technical and non-technical audiences.
- Provide deep technical incident response support, including forensic analysis, custom scripting, and tool development during security investigations.
- Performs other related duties as assigned.
