GRC Engineer

Just Eat Takeaway.com is a leading global online delivery platform. Its tech platform connects tens of millions of customers with hundreds of thousands of restaurant, grocery and convenience partners across the globe.

About this role

We are looking for a skilled software engineer with basic internal control knowledge to build the AI agents running our control monitoring. In this engineering-first role, you will pair with experienced GRC and audit colleagues who translate regulatory expectations into specifications. Your focus is teamwork to deliver, turning those specifications into highly functional, robust production agents.

You will design AI agents that ingest signals from cloud platforms, identity providers, and CI/CD pipelines to deliver structured evidence. Over time, we will care for your growth, helping you naturally pick up the GRC vocabulary needed to scale your impact. We are looking for someone who has shipped production systems with LLMs and is excited to apply those skills to a highly scrutinized domain.

These are some of the key components to the position:

• Build AI agents that perform continuous control monitoring — ingesting logs and configuration data, reasoning over them with LLMs, and producing structured evidence about whether a given control is operating.
• Design the agent architecture end to end — tool definitions, retrieval over policy and control documentation, prompt and model versioning, evaluation harnesses, and the human review loop that sits in front of any agent conclusion that matters.
• Build the integrations that feed the agents — APIs and data pipelines for AWS / GCP / Azure logs, Okta, GitHub, Jira, CI/CD systems (like GitHub Actions), and our data warehouse.
• Build the evaluation layer that lets us trust the agents — regression suites, golden datasets, drift detection, and clear logging of what the agent saw, what it concluded, and why.
• Automate remediation and ticketing workflows where the agent identifies an exception, with sensible guardrails on what runs autonomously and what requires a human.
• Build dashboards and reporting that show control health to control owners and to our risk committees.
• Work with GRC colleagues so that what you build maps to what they need — they will own the framework interpretation; you will own the implementation.
• Be thoughtful about the AI risks in your own system — prompt injection, data leakage, hallucination, over-reliance.

What will you bring to the team?

• Strong Python skills with a track record of building, shipping, and maintaining production systems, backed by standard fundamentals (Git, testing, CI/CD, REST APIs, databases).
• Hands-on experience building and scaling non-prototype AI systems (RAG, agents, structured extraction) using frameworks (e.g., LangGraph, CrewAI) or raw APIs, plus exposure to LLM evaluation tooling (e.g., Braintrust, LangSmith).
• Practical experience with a major cloud platform (AWS, GCP, Azure) with the ability to confidently navigate IAM, pull logs, and analyze audit trails.
• Prior experience working within regulated environments, handling audits, or implementing policy-as-code/detection-as-code frameworks (e.g., OPA, Cedar).
• Ability to write exceptionally clear, plain-English documentation tailored to both technical engineers and non-technical auditors.
• Comfortable representing engineering in compliance discussions, translating complex audit findings, and demonstrating an open, fast-learning mindset.