Sr. Security Engineer - GRC Frameworks & AI Governance

SpaceXSI is seeking an experienced GRC Engineer to design, automate, and continuously validate security and AI governance controls across multiple regulatory environments.

Responsibilities

• Own security compliance implementation and audits across core frameworks: SOC 2 , NIST CSF , NIST SP 800-53 , ISO 27001 , ISO 42001 , and the EU AI Act ; cover control design, mapping, gap assessments, evidence collection, and remediation tracking.
• Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code , automated control validation, continuous evidence pipelines, and monitoring embedded into development and deployment workflows.
• Operate and extend GRC platforms (example: Vanta ) as the system of record for controls, evidence, and audit readiness; integrate with cloud, identity, and engineering tooling to reduce manual effort.
• Partner with engineering and architecture to embed compliance expectations early in design reviews; translate framework requirements into technical control narratives that support auditor needs without slowing delivery.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures supporting governance and the company’s AI management system posture.
• Identify, assess, and prioritize risks across AI/ML operations , cybersecurity , regulatory compliance , data privacy , intellectual property , and cloud deployments ; distinguish material business risk from compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with focus on AI system risks (data handling, model governance, agentic and conversational surfaces).
• Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; act as the bridge between auditors and internal teams to keep requests reasonable, clear, and aligned with the company’s stack.
• Champion a company-wide security and compliance culture by educating teams on the purpose of controls in addition to enforcing requirements.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments ( AWS , GCP , or Azure ).
• Expert working knowledge of several of: SOC 2 , NIST CSF , NIST SP 800-53 , ISO 27001 , and ISO 42001 , including building and running controls.
• Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta , Drata , or similar), with a bias toward continuous monitoring .
• Ability to evaluate control objectives against real IT and cloud configurations and to collaborate with engineers on remediation.

Technologies

• SOC 2, NIST CSF, NIST SP 800-53
• ISO 27001, ISO 42001
• EU AI Act
• Compliance-as-Code, policy-as-code
• GRC platforms, Vanta, Drata
• AWS, GCP, Azure
• CI/CD, IAM
• Logging and monitoring, encryption, infrastructure hardening
• NIST AI RMF, GDPR, CCPA, HIPAA, SOX / ITGC
• FedRAMP, NIST 800-171, CMMC

Preferred Skills and Experience

• 10+ years of security compliance, GRC engineering, or technology audit-related experience.
• Hands-on implementation of technical controls (e.g., IAM , logging and monitoring , encryption , infrastructure hardening ) and integration of compliance checks into CI/CD pipelines .
• Experience in tech or AI/ML, especially startups or high-growth product organizations.
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, particularly in a publicly traded or IPO-bound company.
• Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF , ISO 42001 , EU AI Act ) and associated operational risks.
• Working knowledge of data privacy frameworks (e.g., GDPR , CCPA ) in a technology or cloud environment.
• Strong analytical, problem-solving, organizational, and project management skills to take compliance programs from conception to audit-ready launch.
• Excellent communication and stakeholder management skills for explaining risk and tradeoffs to engineers, legal, sales, and executives.
• Certifications such as CISSP , CISA , CISM , CRISC , CGEIT , ISO 27001 Lead Implementer/Auditor , or similar.
• Experience with public sector or federal compliance programs (e.g., FedRAMP , NIST 800-171 , CMMC ) is a plus.

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

Compensation

• $152,000 - $258,000 USD
• Base salary is part of a total rewards package including equity, medical, vision, dental, 401(k), short & long-term disability, life insurance, and other discounts and perks.

ITAR Requirements

• Applicant must be a U.S. citizen or national , U.S. lawful permanent resident (green card holder), Refugee under 8 U.S.C. § 1157 , or Asylee under 8 U.S.C. § 1158 , or be eligible to obtain required authorizations from the U.S. Department of State .