Applications Security and Compliance Engineer at Octanner · Salt…

Applications Security and Compliance Engineer Location: USA - Utah-Salt Lake City-Headquarters O.C. Tanner is the global leader in software and services that improve workplace culture through meaningful employee experiences. Our Culture Cloud is a suite of apps designed to enhance the employee experience with strategic recognition, service awards, wellbeing, leadership, and events that help people thrive at work. Our Culture by Design approach provides expert services to organizations looking to create great workplaces. Our global team of 1,500 people hail from 58 countries and speak 62 languages. As programmers, researchers, designers, client professionals and craftspeople we create the tech, tools and awards that connect employees to purpose at thousands of companies. Join us as we help people all over the world thrive at work. This role is responsible for implementing, operating, and optimizing the Drata GRC platform, with a strong emphasis on automation, integrations, and continuous compliance monitoring. The Application Security and Compliance Engineer partners closely with the Compliance Analyst team to enable efficient evidence collection, control testing, and audit readiness, while also providing leadership with accurate, actionable compliance metrics. In addition, this role contributes to Application Security initiatives using Snyk and supports broader Information Security projects across the organization. This is a hands-on technical role operating at the intersection of GRC, Application Security, and Security Engineering within a cloud-based SaaS environment. Key Responsibilities GRC Platform Ownership & Automation Lead the implementation, configuration, and ongoing administration of the Drata GRC platform, including control frameworks, testing schedules, and evidence workflows. Establish, maintain, and optimize integrations between Drata and source systems such as cloud infrastructure, identity providers, code repositories, and security tooling. Design and implement automated control testing and evidence collection to reduce manual effort and improve audit reliability. Monitor control health, identify integration or testing failures, and drive timely remediation. Compliance Enablement & Metrics Support the Compliance Analyst team in their use of Drata, including workflows, evidence expectations, and continuous compliance operations. Partner with compliance leadership to ensure accurate representation of control status and maturity. Develop and maintain compliance metrics and dashboards for leadership, including audit readiness, control coverage, and risk trends. Assist with audit preparation and execution for frameworks such as SOC 2, ISO 27001, and other regulatory requirements. Application Security Support Application Security programs using Snyk, including SAST, open source dependency monitoring, and vulnerability remediation workflows. Partner with Engineering teams to embed security into CI/CD pipelines and development processes. Track, triage, and report on application security findings in collaboration with product and engineering stakeholders. Information Security Projects Contribute to broader Information Security initiatives such as control design, process improvement, tooling enhancements, and risk reduction efforts. Collaborate with CloudOps, Engineering, Legal, Privacy, and Compliance teams on security and compliance-related projects. Maintain clear documentation for controls, procedures, integrations, and operational processes. Qualifications Required: 3+ years of experience in information security, compliance engineering, application security, or GRC-related roles. Hands-on experience implementing or operating a GRC platform such as Drata. Experience integrating SaaS platforms, cloud services, and security tools for automated evidence collection. Working knowledge of application security concepts including SAST and open source risk. Familiarity with compliance frameworks such as SOC 2 and ISO 27001. Strong documentation, communication, and cross-functional collaboration skills. Strong scripting, development, or automation skills Preferred: Experience supporting cloud-native SaaS environments. Experience with Snyk or similar application security tooling. Scripting or automation experience (e.g., Python, APIs, workflows). Prior experience supporting external audits or continuous compliance programs.