GRC Engineer; Governance Risk and Compliance

Who we are:

Through a partnership-based approach, Coterie helps insurance professionals unlock untapped revenue in the small commercial space. With an innovative quoting platform that delivers accurate pricing and bindable quotes in less than one minute, Coterie makes small business insurance effortless.

We are on a mission to build and foster a world-class team to bring speed, simplicity, and service to commercial insurance. We value integrity, humility, passion, and intelligence. If you want to push yourself and reshape a $200B+ market, we’re excited to talk to you!

Position Summary:

Coterie's GRC team is seeking a GRC Engineer to help build, test, and improve how we manage and validate security, technology, and compliance controls. This hands‑on technical role focuses on continuous control monitoring, application and technology control testing, risk evaluation, and the collection and validation of audit evidence directly from source systems.

The ideal candidate combines a strong understanding of risk and controls with the technical ability to work directly with systems and data. You will build and perform control testing, identify control and process gaps, assess associated risk, and recommend practical remediation or compensating controls. You will also support broader GRC initiatives, including risk management, BC/DR, privacy, and other program priorities as needed.

• - Build and maintain repeatable testing and monitoring processes for security, technology, and application controls.
• - Define how controls will be tested, including testing procedures, evidence requirements, frequency, expected results, and exception criteria.
• - Perform control testing to assess design and operating effectiveness and document testing procedures, results, and conclusions.
• - Identify control failures, process gaps, control drift, and evidence deficiencies, and assess the related risk and compliance impact.
• - Investigate the cause of identified deficiencies and work with control owners to develop practical remediation or compensating controls.
• - Design and implement practical solutions to automate evidence collection, control testing, and continuous monitoring using queries, scripts, APIs, integrations, and GRC tooling where appropriate.

• - Retrieve evidence directly from applications and source systems on behalf of control owners for audits, assessments, and control testing.
• - Build and document repeatable procedures for collecting and validating technical evidence, including system reports, configurations, access data, logs, vulnerability results, and change records.
• - Validate the completeness, accuracy, scope, and reliability of system‑generated evidence and data used for testing and audits.
• - Support SOC 2, ITGC/SOX readiness, NYDFS, and other audit and compliance activities, including walkthroughs, evidence requests, testing, and auditor follow‑up.
• - Maintain organized, audit‑ready evidence and testing documentation and retest remediated controls as needed.

• - Assess the effectiveness of security and technology controls in mitigating their associated risks.
• - Translate regulatory, audit, and security requirements into practical control requirements and testing procedures.
• - Identify control and process gaps, assess the associated risk, and recommend control improvements, compensating controls, or other risk treatment options.
• - Support technical risk assessments, remediation planning, and other risk management activities.

• - Support GRC initiatives across risk management, business continuity and disaster recovery, privacy, third‑party risk management, governance, and regulatory…