Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 hours ago

GRC Engineer

Reflection AI46 open roles

Where
New York, NY
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC EngineerReflection AI · New York, NY

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Reflection AI's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

8.2% of postings close within 7 days. Measured by our own scanner across the market. Reflection AI postings stay open a median of 42 days.

Share of postings closed within
  1. 1.9%1 day
  2. 3.8%3 days
  3. 8.2%7 days
  4. 15.2%14 days
  5. 34.1%30 days
This job: posted 8 hours ago

Reflection AI median: 42 days open

The posting

OUR MISSION

Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all.

ROLE SUMMARY

Reflection AI's Compliance and AI Governance function spans six pillars: AI Governance, Data Governance, Trade Compliance, Privacy Operationalization, Government Contracting Compliance, and Corporate Compliance. The team builds the policies, controls, and operating rhythms that let the company move fast while staying defensible with regulators, customers, and partners. This role sits at the intersection of compliance and engineering, partnering most closely on technical controls required by Security frameworks, AI Governance frameworks, Privacy, and Data Governance pillars to translate policy requirements into technical controls that scale.

We're looking for a Governance, Risk, & Compliance engineer who wants to work on compliance as a product problem rather than a paperwork problem. You'll build and maintain the technical infrastructure (tooling, pipelines, automated controls, evidence collection) that lets the compliance program operate at engineering scale instead of through manual review. A core part of the job is keeping our security framework compliance (SOC 2, ISO 27001, NIST) running on automated evidence rather than manual screenshotting, and building out the technical side of our Trade Compliance, Privacy, Data Governance, and TPRM program. You'll be the technical translator between compliance requirements and the engineering and security teams that have to implement them.

WHAT YOU'LL DO

- Design and build automated controls and monitoring that satisfy security framework requirements (SOC 2, ISO 27001, NIST 800-53/800-171, CMMC): access reviews, data minimization, model/data lineage, continuous evidence collection

- Partner with Engineering, Security, and IT to implement technical requirements arising from security frameworks, deemed export controls, and privacy regulations

- Build and maintain internal tooling that supports compliance workflows (intake forms, screening checks, reporting dashboards, GRC platform integrations such as Vanta)

- Translate regulatory and policy requirements into concrete technical specifications engineering teams can implement

- Support technical due diligence for inbound customer security questionnaires, audits, and outbound vendor assessments

- Maintain integrations between compliance/GRC systems and source-of-truth systems (identity, data infrastructure, model pipelines)

- Help scope and support technical environment separations or system boundaries required for regulatory compliance (e.g., subsidiary or enclave environments)

WHAT WE'RE LOOKING FOR

- 3-6 years of software engineering, security engineering, or DevOps/infrastructure experience

- Hands-on experience supporting at least one security framework (SOC 2, ISO 27001, or NIST) as an engineer, not just as a subject

- Comfortable writing production-quality code (Python, or similar) and working with APIs/integrations

- Experience translating non-technical requirements (policy, regulatory, contractual) into technical implementation

- Familiarity with cloud infrastructure and identity/access management concepts

- Strong collaboration skills; able to work effectively with compliance, legal, and engineering stakeholders who don't share a common vocabulary

- Experience building or maintaining GRC tooling, TPRM/vendor risk platforms, or compliance automation (e.g., Vanta or similar)

- Familiarity with one or more relevant frameworks: CMMC, NIST 800-171/800-53, SOC 2, ISO 27001, GDPR/CCPA technical requirements

- Experience with data governance or data lineage tooling, especially in ML/AI pipelines

- Background supporting a government contracting or regulated environment

WHAT WE OFFER:

We believe that to make intelligence open and accessible to all, you need to start at the foundation. Joining Reflection means building from the ground up as part of a talent-dense team. You will help define our future as a company, and help define the future of open foundational models.

We want you to do the most impactful work of your career with the confidence that you and the people you care about most are supported.

- Top-tier compensation: Salary and equity structured to recognize and retain our talent globally.

- Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options.

- Health & wellness: Comprehensive medical, dental, vision, and life, with an annual wellness allowance.

- Meals: Lunch and dinner are provided in the office daily.

- Life & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.

- Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K.

- Sponsorship support: We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable.

- Team building: We have regular off-sites, happy hours, and team celebrations.

Export Control Notice: This position may require access to technology or source code subject to the U.S. Export Administration Regulations. Any offer of employment for this role may be conditioned on the Company's ability to provide the candidate with access to such technology or source code in compliance with applicable U.S. export control laws, which may require the Company to seek government authorization.

Candidate and Employee Privacy Notice: We collect and process personal data about applicants for the purposes described in our Candidate and Employee Privacy Notice https://cdn.sanity.io/files/irpbdun9/production/ee08c38bf22bd45a3f3a81f6a7abddb9210726b7.pdf

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Reflection AI's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Reflection AI's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Reflection AI's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.