Lead Security Engineer, GRC

Responsibilities

• Build evidence-collection pipelines and map evidence to normalized compliance control models.
• Construct reusable collectors and schemas so new controls can be assembled efficiently.
• Establish a system of record for controls, mappings, and evidence and lead build-versus-buy analysis.
• Detect control drift and route findings to system owners with remediation and risk-acceptance paths.
• Translate CMMC, NIST 800-171, NIST 800-53, FedRAMP, and related frameworks into automated technical checks and pass/fail signals.
• Set technical direction and mentor a growing engineering team.

Requirements

• At least 6 years of experience in security engineering, GRC, or a related role, including hands-on automation or data-pipeline development.
• Strong programming ability in a general-purpose language such as Go, Python, or Rust.
• Hands-on experience operationalizing CMMC, NIST 800-171, NIST 800-53, FedRAMP, or SOC 2 compliance frameworks.
• Experience designing data collection and integrations across cloud and SaaS systems, including APIs, log/event pipelines, and data lakes.
• Production experience with infrastructure as code such as Terraform or AWS CDK.
• Track record of setting technical direction and mentoring engineers.
• Ability to work autonomously, own ambiguous problems, and drive alignment across partner teams.
• Eligibility to obtain and maintain a U.S. Secret clearance.
• Preferred experience with continuous control monitoring or GRC platforms such as Vanta, Drata, Hyperproof, or OneTrust, or with building equivalent systems.
• Preferred experience with security data lakes, log aggregation, or data marts for querying.
• Preferred familiarity with STIG/ConMon scanning, CSPM, or Kubernetes hardening.
• Preferred experience in fast-paced, high-growth defense technology environments.

Benefits

• Competitive full-time benefits package available at little to no cost to employees.
• Highly competitive equity grants are included in the majority of full-time offers and are part of the total compensation package.