Build the swarm

You will build the content our customers' agents run on: control libraries, framework mappings, risk registers, and the audit workflows that turn them into evidence. You know what a well-written control looks like, and you can write it down in a form that a swarm of agents applies the same way every time.

What you will do

• Design and maintain the unified control library and its mappings to SOX, SOC 2, ISO 27001, NIST CSF, PCI DSS, and the other frameworks our customers audit against.
• Author audit and testing workflows (planning, walkthroughs, sampling, test of design and operating effectiveness, findings, remediation) as reusable templates that agents execute and humans approve.
• Write and tune the skills, prompts, and evaluation sets that keep agent output at the quality a practitioner would sign, and catch it when it drifts.
• Build seed datasets and demo programs (risks, controls, policies, evidence chains) that show a customer their own audit inside the product.
• Sit with internal audit and compliance teams during onboarding and turn what you hear into product and content changes.
• Own the accuracy of all of it. A wrong control mapping will be found by a customer's auditor unless you find it first.

What you bring

• Three or more years in internal audit, SOX or SOC compliance, IT audit, or GRC engineering, with time spent writing and testing controls, not only reviewing them.
• Working fluency in at least two major frameworks and a clear opinion on how to map between them.
• Comfort with structured data: JSON, spreadsheets that behave like databases, and version control. You do not need to be a software engineer, but you should be able to work in a repository.
• Experience using AI agents in your own work, and a clear view of where they are reliable and where they are not.
• Writing that an agent can execute and a partner would sign.

Nice to have

• CIA, CISA, CPA, or equivalent.
• Experience with Workiva, AuditBoard, ServiceNow GRC, or similar platforms, and a view on what they get wrong.
• Scripting in Python or TypeScript.
• Time at a Big Four firm or in a second-line function at a fast-growing company.