GRC Engineer

Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block.

The Role

Block Information Security is an engineering-driven team focused on scaling security through innovation. Our Security Governance team designs and promotes the frameworks and standards that safeguard customer data, elevate security considerations across the company, and simplify regulatory and compliance obligations. The team also operates the agent-first platform that turns those frameworks into running systems.

Most of governance is a data problem. The risk, control, and asset information needed to answer "are we secure and compliant?" is dispersed across dozens of systems: source control, service registries, identity providers, data warehouses, ticketing, CI/CD. GRC Engineers treat that as an engineering problem. You'll build the data pipelines, integrations, and agentic AI workflows that turn manual governance processes into products that run continuously, produce measurable results, and hold up to audit end to end.

You Will

• Build and operate the pipelines and integrations that aggregate, normalize, and join risk, control, and asset signals from systems of record across Block, including source control, the service registry, identity, ticketing, data platforms, and CI/CD
• Translate security standards and compliance requirements into policy-as-code: enforceable, testable rules that run continuously. For example, "every production service has an accountable owner" becomes a versioned, tested check instead of a quarterly spreadsheet
• Design agentic AI workflows that pair LLM reasoning with deterministic, auditable decision layers for evidence analysis, control monitoring, classification, and assessment
• Build the evals, benchmarks, and calibration harnesses that keep automated governance honest
• Automate evidence collection and continuous control monitoring to replace point-in-time audit preparation
• Define the technical approach for ambiguous, cross-team problem spaces. This is an early-stage program, and you will frame problems as often as you solve them
• Partner with Security Governance Partners, Compliance, and Engineering teams to find the manual processes most worth turning into product