Technology Control Automation Specialist

Employee Applicant Privacy Notice Who we are: Shape a brighter financial future with us. Together with our members, we’re changing the way people think about and interact with personal finance. We’re a next-generation financial services company and national bank using innovative, mobile-first technology to help our millions of members reach their goals. The industry is going through an unprecedented transformation, and we’re at the forefront. We’re proud to come to work every day knowing that what we do has a direct impact on people’s lives, with our core values guiding us every step of the way. Join us to invest in yourself, your career, and the financial world. The role: The GRC Control Automation Specialist automates cybersecurity compliance, reducing manual effort and increasing audit reliability. This role blends risk management, cybersecurity operations, and automation engineering to streamline evidence collection and control validation, crucial for SoFi's growth and regulatory demands. The specialist will also manage due diligence inquiries, leveraging automation platforms to scale operations and accelerate business opportunities. Collaboration with control owners, engineers, and audit teams is key to identifying automation opportunities, implementing scripts or integrations, and validating outputs against frameworks like PCI DSS, SOX, and SOC 2. This position supports continuous control monitoring and audit readiness. What you’ll do: Design and architect technology and cybersecurity controls monitoring and testing function, leveraging enterprise compliance automation platforms, agentic AI, tools and workflows. Implement automated monitoring (anomaly detection) and surveillance methods to ensure systems operate within defined guardrails Create risk and compliance dashboards, remediation performance metrics, ticketing criteria, remediation queue monitoring, tracking, measuring and communicating key performance activities for Technology and Cybersecurity library of controls Automate manual cybersecurity and compliance controls and administration of the compliance automation platform for audit support (e.g.,SOC 2, SOX, PCI DSS). Develop automated control enforcement mechanisms (e.g., scripts, APIs, policy checks), integrating controls as code logic into CI/CD pipelines, cloud environments, and endpoint tools. Enable continuous control monitoring (CCM) by developing reusable logic and ensuring automated controls produce auditable evidence. Support internal and external audits by providing access to accurate automated evidence and system logs. Analyze automated test gaps, distinguishing false positives from true findings, and driving remediation. As required, collaborate with security, engineering, business and other stakeholders to collect security questionnaire responses. Maintain a control automation backlog and document all automated control logic. What you'll need: Bachelor's degree or equivalent experience. 3–5+ years in developing AI agents, cybersecurity, GRC, compliance operations, or DevSecOps. Experience with enterprise AI tools and GRC and compliance automation platforms (e.g., Anecdotes, ServiceNow, Auditboard, Drata, Vanta, Safebase). Strong experience in technology risk management, cybersecurity, or compliance Experience integrating governance gates into CI/CD and MLOps pipelines Strong knowledge of security frameworks and standards (e.g., NIST AI RMF, ISO42001, PCI DSS, SOX, GLBA, ISO 27001, NIST CSF, SOC 2). Familiarity with SIEM, cloud platforms (AWS, GCP), IaC, and scripting (e.g., Terraform, Python). Foundational knowledge of cloud architecture and cybersecurity principles. Strong analytical and troubleshooting skills, with an eye for efficiency and risk reduction. Exceptional organizational skills, attention to detail, and ability to manage multiple projects. Excellent documentation, collaboration, and communication skills. AI/LLM Knowledge: understanding of developer productivity tools like Claude Code, Cursor and Large Language Models, agent frameworks (e.g., LangChain, AutoGPT), and RAG architecture. Security Engineering: Strong background in application security, cloud security (AWS/GCP/Azure), and threat modeling. Nice to have: Direct experience with external auditors and regulatory bodies. Professional certifications (e.g., CISSP, CISA, CRISC, AWS Solutions Architect, cloud security). Experience in fintech or financial services. Hands-on experience with API integrations or light scripting. High-level stakeholder management, influence without authority, and ability to navigate ambiguity Compensation and Benefits The base pay range for this role is listed below. Final base pay offer will be determined based on individual factors such as the candidate’s experience, skills, and location. To view all of our comprehensive and competitive benefits, visit our Benefits at SoFi page! SoFi provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion (including religious dress and grooming practices), sex (including pregnancy, childbirth and related medical conditions, breastfeeding, and conditions related to breastfeeding), gender, gender identity, gender expression, national origin, ancestry, age (40 or over), physical or medical disability, medical condition, marital status, registered domestic partner status, sexual orientation, genetic information, military and/or veteran status, or any other basis prohibited by applicable state or federal law. The Company hires the best qualified candidate for the job, without regard to protected characteristics. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. New York applicants: Notice of Employee Rights SoFi is committed to an inclusive culture. As part of this commitment, SoFi offers reasonable accommodations to candidates with physical or mental disabilities. If you need accommodations to participate in the job application or interview process, please let your recruiter know or email accommodations@sofi.com. Due to insurance coverage issues, we are unable to accommodate remote work from Hawaii or Alaska at this time. Internal Employees If you are a current employee, do not apply here - please navigate to our Internal Job Board in Greenhouse to apply to our open roles.