Senior GRC Engineer

About the role

Deliveroo, now part of DoorDash, is hiring a Senior GRC Engineer for its London-based Security Engineering team, which reports directly to the Security Compliance Manager. The role takes primary ownership of tracking regulatory and framework changes, turning them into real controls, and moving compliance from manual work to automation and policy-as-code. It suits someone with deep audit and assurance experience who wants to build the program rather than just brief others.

Key responsibilities

• Build the regulatory and framework change-management process and move compliance work onto Compliance-as-Code foundations, including automated control testing and evidence collection wired into CI/CD.
• Lead major external audits from start to finish and help shape the policies and control standards underpinning the program.
• Design and run agentic workflows for evidence analysis, control testing and audit response, with a human in the loop where needed.
• Work with engineering and architecture teams to design controls into new systems and turn that work into the narratives auditors need.
• Design, implement and validate security controls, and support the development of security policies, standards and guidance.
• Mentor other members of the compliance team and help set the technical bar for the function.

Required profile

• 6+ years of experience in security compliance, GRC or technology risk, in high-growth, technology-driven and regulated environments.
• Bachelor's degree in Information Security, Computer Science or a related field, or equivalent practical experience.
• Experience building large language models and agent workflows, with daily use of AI in your own work and the ability to evidence it to an auditor.
• Ability to identify control gaps, assess risk and drive remediation with cross-functional stakeholders, and to influence technical and non-technical stakeholders.

Required skills

• Familiarity with frameworks such as DORA, the EU AI Act, NIS2 and CRA.
• Hands-on experience implementing and assessing controls against PCI DSS, SOC 2 and ISO 27001.
• Understanding of compliance metrics and reporting, and ability to track control effectiveness, audit outcomes and risk exposure.
• Excellent verbal and written communication, able to explain complex audit and compliance requirements clearly.