Principal, GRC Automation and Cyber Risk

At F5 we strive to bring a better digital world to life. Our teams empower organizations across the globe to create secure and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity from protecting consumers from fraud to enabling companies to focus on innovation.

Everything we do centers around people. That means we obsess over how to make the lives of our customers and their customers better. And it means we prioritize a diverse F5 community where each individual can thrive.

The Principal GRC Automation & Cyber Risk Quantification is a senior engineering and strategic leadership role responsible for designing implementing and scaling automated data-driven cyber risk and GRC capabilities across the enterprise. This role blends deep cyber risk management expertise with hands-on software engineering GRC platform architecture workflow automation API development and systems integration and emerging AI-enabled and Agentic capabilities to modernize how the organization manages risk compliance and governance at scale.

Reporting to the VP Cyber Governance Risk & Compliance this role serves as a force multiplier for the GRC organization translating complex regulatory and risk frameworks into automated controls continuous monitoring workflows decision-ready dashboards and audit-ready evidence. The principal is expected to write review and own production-quality code and partner closely with ERM Engineering IT Legal Privacy Internal Audit and Digital teams to embed risk intelligence directly into business and technology processes.

• Shift GRC from manual point-in-time assessments to continuous automated and risk-informed execution by leveraging purpose-built engineering solutions Python-based tooling and Agentic workflows.
• Enable executive and board-ready cyber risk insights grounded in quantitative and business-relevant data supported by automated data pipelines and integrations.
• Standardize and automate control mapping testing evidence collection and risk reporting across frameworks and regulators through scalable API-driven architectures.
• Act as the technical and architectural authority for ServiceNow IRM and adjacent GRC automation capabilities including custom-developed integrations and Agentic automation agents.

• Design build and evolve end-to-end GRC automation across risk compliance policy and issue management domains including writing and maintaining Python-based automation scripts services and tools.
• Integrate GRC workflows with source systems (cloud platforms vulnerability tools IAM SDLC third-party systems) via RESTful APIs webhooks and event-driven integration patterns to reduce manual effort and improve data quality.
• Architect and maintain a systems integration layer connecting GRC platforms to enterprise data sources enabling real-time risk signal ingestion and automated control validation.

• Partner with Cyber Risk leadership to operationalize quantitative and scenario-based risk analysis (e.g. FAIR-aligned methods).
• Engineer automated pipelines for ingesting threat vulnerability asset and business context data to support risk-based prioritization leveraging Python data processing libraries (e.g. pandas NumPy) integration APIs and Agentic work flows.
• Enable financially grounded cyber risk outputs that inform:
  • Risk acceptance and investment decisions
  • Executive and board-level reporting
  • Program prioritization and roadmap planning

• Translate regulatory and framework requirements into automated testable and traceable controls implementing these as code-driven workflows and API-integrated monitoring checks.
• Implement continuous control monitoring and evidence refresh to support ISO SOX SOC and regulatory audits using automated evidence collection scripts and scheduled integrations.
• Reduce audit fatigue by standardizing artifacts workflows and control narratives across compliance programs.
• Partner with Internal Audit and external auditors to improve transparency timeliness and defensibility of GRC outputs.

• Design build and deploy Agentic automation solutions autonomous AI-driven agents capable of reasoning across GRC data identifying risks triggering workflows and recommending actions with minimal human intervention.
• Identify and pilot AI-assisted capabilities to accelerate GRC outcomes such as:
  • Control mapping and gap analysis
  • Risk scenario generation and prioritization
  • Policy-to-control alignment and impact analysis
  • Agentic issue triage intelligent remediation recommendations and autonomous evidence collection
• Develop and integrate LLM-based or agent-framework tooling (e.g. LangChain AutoGen or comparable frameworks) into GRC workflows.
• Ensure all AI-enabled and Agentic GRC use cases align with internal security privacy and governance standards.

• Design develop and maintain RESTful and GraphQL APIs that expose GRC data and capabilities to downstream consumers including dashboards reporting tools and integrated enterprise systems.
• Own the end-to-end systems integration architecture connecting GRC platforms to security tools cloud environments HR systems asset management and third-party risk platforms.
• Establish and enforce API governance standards including versioning authentication documentation (OpenAPI/Swagger) and rate management.
• Build and maintain integration middleware ETL pipelines and event-driven connectors to ensure consistent reliable data flows across GRC systems.

• Serve as a trusted advisor to security IT engineering and business leaders on risk-based automation control design and engineering best practices for GRC tooling.
• Influence teams to embed GRC requirements directly into SDLC cloud procurement and third-party workflows.
• Translate technical implementations including architecture diagrams API designs and automation logic into clear executive-ready narratives for leadership consumption.

• Deep understanding of cyber risk management and GRC frameworks (NIST CSF NIST 800-53/171 ISO 27001 SOC 2 SOX).
• Strong grasp of enterprise risk management (ERM) concepts and alignment.
• Working knowledge of quantitative cyber risk analysis (FAIR or similar approaches).
• Familiarity with audit regulatory and certification processes.
• Understanding of software engineering principles API design patterns and systems integration methodologies.
• Knowledge of Agentic AI frameworks and multi-agent system design principles.

• Expertise designing and automating workflows within ServiceNow IRM or comparable GRC platforms.
• Proficient Python developer able to write clean maintainable production-ready code for automation scripts data pipelines API clients and Agentic workflows.
• Experienced in API development and integration designing and consuming REST APIs managing authentication (OAuth API keys) and building integration layers.
• Demonstrated systems integration experience connecting heterogeneous enterprise systems through APIs webhooks message queues or ETL frameworks.
• Hands-on experience with Agentic development building autonomous AI agents using frameworks.
• Ability to translate abstract frameworks into practical automated and scalable implementations.
• Strong systems thinking connecting people process technology and data.
• Excellent written and verbal communication skills including executive-level storytelling.

• Operate comfortably at both strategic and hands-on engineering levels.
• Influence without authority in a highly matrixed environment.
• Drive change from legacy/manual processes to modern code-driven automated execution.
• Independently scope build and ship engineering solutions with minimal oversight.

• Bachelors degree in Cybersecurity Information Systems Computer Science Engineering Risk Management or related field.
• 10 years of experience across cybersecurity risk management GRC or security architecture roles with at least 35 years in a hands-on engineering or software development capacity.
• Demonstrated Python programming proficiency applied to automation data processing tooling or security use cases.
• Proven API development and integration experience including designing building and consuming APIs in enterprise environments.
• Demonstrated systems integration experience connecting GRC security cloud or enterprise systems at scale.
• Demonstrated experience automating or scaling GRC risk or compliance programs using enterprise platforms.
• Strong experience partnering with cross-functional technical and business teams.

• Masters degree in a related field.
• Experience with FAIR or quantitative risk methods.
• Hands-on experience with Agentic AI development building and deploying autonomous agents for task automation decision support or workflow orchestration.
• Familiarity with LLM orchestration frameworks (LangChain LangGraph AutoGen CrewAI or similar).
• Experience with Python data and automation libraries (pandas NumPy FastAPI Celery Airflow etc.).
• Experience with API gateway tooling integration platforms (e.g. MuleSoft Boomi Workato) or message broker systems (Kafka RabbitMQ).
• Hands-on experience with AI data analytics or workflow automation applied to GRC use cases.
• Professional certifications (CISSP CISM CRISC Open FAIR).

This role is foundational to advancing the organizations GRC maturity by reducing friction increasing signal and enabling leadership to make faster better-informed risk decisions. It is a highly visible engineering leadership position with direct impact on executive confidence audit outcomes and enterprise risk posture. The ideal candidate is equally comfortable writing Python code and building Agentic workflows as they are presenting risk insights to a board of directors a rare blend of engineering depth and strategic influence that will define the next generation of GRC capability.

The Job Description is intended to be a general representation of the responsibilities and requirements of the job. However the description may not be all-inclusive and responsibilities and requirements are subject to change.

F5 maintains broad salary ranges for its roles in order to account for variations in knowledge skills experience geographic locations and market conditions as well as to reflect F5s differing products industries and lines of business. The pay range referenced is as of the time of the job posting and is subject to change.

You may also be offered incentive compensation bonus restricted stock units and benefits. More details about F5s benefits can be found at the following link: F5 reserves the right to change or terminate any benefit plan without notice.

Please note that F5 only contacts candidates through F5 email address (ending with @) or auto email notification from Workday (ending with or @).

Equal Employment Opportunity

It is the policy of F5 to provide equal employment opportunities to all employees and employment applicants without regard to unlawful considerations of race religion color national origin sex sexual orientation gender identity or expression age sensory physical or mental disability marital status veteran or military status genetic information or any other classification protected by applicable local state or federal laws. This policy applies to all aspects of employment including but not limited to hiring job assignment compensation promotion benefits training discipline and termination. F5 offers a variety of reasonable accommodations for candidates. Requesting an accommodation is completely voluntary. F5 will assess the need for accommodations in the application process separately from those that may be needed to perform the job. Request by contacting .