Staff Security Governance Engineer, Policies & Standards

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Governance Engineer, Policies & Standards based in United States. This role offers the opportunity to shape how security policies and standards are created, maintained, communicated, and measured across a global technology environment. You will translate evolving regulations and security frameworks, including emerging AI requirements, into practical guidance that engineering, product, legal, and security teams can apply. As a senior individual contributor, you will own policy governance while helping make security and compliance processes more automated, measurable, and continuous. You will work closely with Security Compliance, Security Risk, GRC Engineering, Product, Legal, and Engineering teams. The position combines governance expertise with technical understanding of cloud, SaaS, DevSecOps, and automation. Working remotely and asynchronously, you will have broad scope and visible impact while helping establish the future direction of security governance. Accountabilities: - Own the complete lifecycle of security policies, standards, procedures, and guidelines, including drafting, stakeholder review, approval, publication, periodic review, and retirement. - Define and operate a risk-based exception management process covering approvals, expiration tracking, adherence trends, and recommendations for policy improvements. - Manage policy attestation activities, investigate non-adherence, and develop measurable indicators of policy effectiveness and adoption. - Monitor emerging regulations and security standards, including AI-focused requirements, and collaborate with Legal to assess their impact and update policies ahead of compliance deadlines.

- Maintain mappings between internal policies and frameworks such as SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF to enable requirements to be reused effectively. - Conduct targeted internal assessments, coordinate remediation efforts, and support audits through evidence collection, testing, and remediation management. - Support customer security questionnaires and meetings while identifying recurring customer needs that can be addressed through stronger policies and self-service resources. - Identify and implement automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessment activities in partnership with GRC Engineering. - Provide technical and program leadership across Security, Product, Legal, and Engineering, influencing stakeholders without direct authority while mentoring colleagues and helping shape the Security Governance roadmap. Requirements - 10+ years of experience in security governance, GRC, IT risk, or a related field, with hands-on ownership of policy and standards lifecycles and a track record of measurable outcomes. - Strong working knowledge of security and compliance frameworks including SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, with the ability to apply them in practical operational environments. - Understanding of cloud, SaaS, and DevSecOps practices, with the ability to create security policies that are clear, practical, and actionable for engineering teams. - Strong risk-based approach, balancing regulatory and compliance requirements with real-world security risks and operational needs. - Demonstrated experience using automation or AI to reduce manual governance, risk, and compliance activities. - Excellent written and verbal communication skills, with the ability to translate technical and regulatory concepts for engineers, executives, auditors, customers, and other stakeholders. - Proven ability to collaborate effectively across Security, Product, Legal, and Engineering teams and influence decisions without direct authority.