Principal Security Engineer – GRC Team Lead (Remote Eligible)

For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day.

Smartsheet's GRC function is at an inflection point. As we scale our compliance programs across multiple frameworks (SOC 2, ISO 27001, FedRAMP, HIPAA, and emerging regulations), the manual work is becoming unsustainable. We need a technical GRC leader—someone who understands both compliance deeply and how to engineer solutions. As GRC Team Lead, you'll architect the technical foundation for how Smartsheet manages risk and compliance at scale. You'll design policy-as-code systems, build custom control frameworks aligned with our unique architecture, manage full audit cycles, and lead process improvements that make our GRC function a scalable engine. This is a principal-level role combining compliance expertise with technical execution. You'll be responsible for the strategy and delivery of GRC automation, evidence collection systems, audit readiness, risk management workflows, and technical control implementation. You'll work across security, engineering, and product teams to embed compliance into operations and reporting. This is an excellent opportunity to define how a world-class SaaS company approaches GRC in 2026 and beyond.

What You Will Do

• Own the end-to-end GRC strategy and roadmap: Lead the planning and prioritization of GRC initiatives that drive compliance maturity, reduce audit risk, and improve operational efficiency.

• Design and implement policy-as-code systems: Translate compliance frameworks (SOC 2, ISO 27001, FedRAMP, HIPAA) into enforceable code, leveraging Infrastructure-as-Code (Terraform, CloudFormation) and automated compliance validation.

• Build custom control frameworks: Design Smartsheet-specific Unified Control Frameworks (UCF) and Secure Control Frameworks (SCF) that map to our cloud architecture, multi-framework requirements, and organizational risk appetite.

• Lead full audit cycles: Manage preparation, execution, and resolution for SOC 2 Type II, ISO 27001, FedRAMP, and other certification audits. Own evidence gathering, audit readiness tracking, and post-audit remediation.