GRC Engineer

Cape is America’s privacy-first mobile carrier. Our mission is to be a force for good in global wireless. Cape was founded in 2022 by people who believe privacy is a fundamental right, not a luxury to be traded away. Our journey began when our founder recognized a critical vulnerability in our modern world: everyone relies on the same stagnant cellular infrastructure and legacy systems that track our every movement, monitor and profile our connections, and lose and sell our personal data.

Instead of accepting the status quo, we decided to fix it. National security professionals, journalists, parents, and everyone in between can stay connected and have privacy.

We didn’t just build a layer on top of old tech; we built America’s most private and secure mobile carrier from the ground up. By building our own network from scratch, we are able to design and build a suite of privacy and security features that no other carrier on the planet can offer.

Today, Cape provides our secure network to consumers, businesses, and government agencies alike. We closed our Series C in March 2026, and we are scaling rapidly, with the goal of giving people back control of their most personal information.

At Cape, we are the architects of a privacy-centric movement that is just getting started. We are relentless builders, constantly innovating at the edge of what's possible in telecommunications. We operate on a foundation of high trust and high expectations. Our structure is flat, and collaboration matters more than hierarchy. As a member of our team, you will collaborate with world-class engineers, architects, and visionaries, and work across organizational lines to solve "impossible" problems and deliver mission-critical results for our users every single day.

We are looking for a GRC Engineer to help grow the governance, risk, and compliance function that keeps Cape secure, trustworthy, and audit-ready as we scale. You will sit at the intersection of security, engineering, and compliance — translating regulatory and contractual requirements into automated controls, clear policies, and pragmatic engineering solutions. You are equally comfortable writing a policy as you are writing a script to enforce it.

As a steward of Cape culture, you will partner with engineering and security leaders to identify and remediate risk, run our compliance programs (SOC 2, CMMC, and beyond), and support customers through security due diligence. You put people and data first and always use evidence to drive decisions. You'll join an existing GRC function and are passionate about building on its foundation, sharpening our automation, and helping it scale with the business.

This role reports to our Head of Security.

• Design, build, and maintain automated systems for continuous controls monitoring across our cloud infrastructure (AWS/GCP/Azure), CI/CD, and SaaS stack.

• Own and mature our compliance programs end-to-end (SOC 2 Type II, CMMC, and future frameworks as they arise), including audit prep, evidence collection, and remediation tracking.

• Provide subject matter expertise in: risk assessment, controls design, security policy, vendor/third-party risk, access review automation, and audit management.

• Proactively assess technical and organizational risk, make data-driven recommendations, and implement scalable solutions rather than one-off manual fixes.

• Roll up your sleeves to execute a full range of GRC duties — from writing policy to shipping the automation that enforces it.

• Collaborate closely with Security and Engineering to implement solutions across risk management, policy, and compliance tooling.

• Ensure successful rollout of key GRC programs such as risk registers, access reviews,…