Commercial GRC Engineer - Sr. Security Engineer I

For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for peopl...

Smartsheet maintains certifications and attestations across SOC 2 Type II, the ISO 27001/27017/27701/22301 suite, HIPAA, and other commercial compliance frameworks—and the manual work of proving those controls quarter after quarter doesn't scale with the business. We're looking for a Sr. Security Engineer I to bring...

This role reports to the Senior Director, GRC Engineering and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer.

4+ years of experience in GRC engineering, security engineering, compliance automation, or IT audit support, with hands-on ownership of at least one full certification cycle (SOC 2, ISO 27001, or similar).
Practical, hands-on experience with GRC or compliance automation platforms (Vanta, Drata, Secureframe, or a homegrown equivalent), including configuring integrations and building evidence pipelines—not just reading dashboards.
Experience with cloud security fundamentals (AWS/GCP/Azure IAM, logging, encryption) and how they map to control requirements.
Solid working knowledge of SOC 2, ISO 27001 (and ideally 27017/27701), and HIPAA control requirements, and the ability to map controls across frameworks to avoid duplicated evidence work.
Comfort with scripting or light development (Python, JavaScript, or similar) to build integrations, automate evidence pulls via API, or extend GRC tooling.
Strong written communication; you can document a control, a gap, and a remediation plan clearly enough that an external auditor and an internal engineer both understand it.
A stakeholder-centric mindset: you measure success by how easy it is for engineers to stay compliant, not just by how quickly GRC can produce evidence.
Demonstrated ability to trace a control failure or audit finding back to its root cause and drive a durable fix across teams.
Legally eligible to work in the U.S. on an ongoing basis.
Current US Perks & Benefits:
Employer subsidized medical/vision and dental coverage for full-time employees
401k Match to help you save for your future (50% of your contribution up to the first 6% of your eligible pay)
Monthly stipend to support your work and productivity
Flexible Time Away Program, plus Sick Time Off
US employees are automatically covered under Smartsheet-sponsored life insurance, short-term, and long-term disability plans
US employees receive 12 paid holidays per year
Up to 24 weeks of Parental Leave
Personal paid Volunteer Day to support our community
Opportunities for professional growth and development including access to Udemy online courses
Company Funded Perks, including a counseling membership, local retail discounts, and your own personal Smartsheet account
Teleworking options from any registered location in the U.S. (role specific)
Smartsheet provides a competitive base salary range for roles that may be hired in different geographic areas we are licensed to operate our business from. Actual compensation is determined by several factors including, but not limited to, level of professional, educational experience, skills, and specific candidate location. In addition, this role will be eligible for a market competitive incentive opportunity.
US Base Salary Pay Range
$175,000—$227,500 USD
 
Get to Know Us:
At Smartsheet, your ideas are heard, your potential is supported, and your contributions have real impact. You’ll have the freedom to explore, push boundaries, and grow beyond your role. We welcome diverse perspectives and nontraditional paths—because we know that impact comes from individuals who care deeply and challenge thoughtfully. When you’re doing work that stretches you, excites you, and connects you to something bigger, that’s magic at work. Let’s build what’s next, together.