Security Engineer (GRC Sales)

xAI; Ashington; On-site; GBP 80,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Visa sponsorship

401(k) plan

Job summary

xAI is seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional for third-party risk management and customer trust in Ashington, UK. The role blends cybersecurity GRC with presales, gaining deep knowledge of SpaceXSI tech stacks to answer vendor questionnaires and support customer diligence.

You will own responses to vendor security questionnaires, maintain a reusable knowledge base, and work with Engineering, Legal, and Product to ensure evolving controls and architecture are

Qualifications

• Bachelor’s degree in CS, information security, cybersecurity, or STEM field.
• 5+ years in cybersecurity, GRC, or third-party risk with customer-facing duties.
• Experience completing vendor security questionnaires and security due-diligence discussions.

Responsibilities

• Own and improve responses to vendor security questionnaires, RFPs, and assessments.
• Present security posture to customers during meetings as SME.
• Coordinate with Engineering, Legal, and Product to keep security content up to date.

Skills

Vendor risk management

GRC & security assurance

Presales security

Customer-facing communication

Security questionnaires

Education

Bachelor’s degree in CS/InfoSec/Engineering

Tools

Vanta

Drata

SOC 2 / ISO 27001 knowledge

Job description

• We are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management and customer trust
• This role sits at the intersection of cybersecurity GRC, vendor management, and sales enablement: you will act as a security-minded presales engineer for the sales team, develop enough depth in the SpaceXSI technical environment to accurately complete customer vendor security questionnaires, join customer meetings as the security and compliance subject matter expert, and help operate third-party risk and vendor management processes
• Support the sales organization as a cybersecurity/GRC presales partner: attend customer and prospect meetings, present our security and compliance posture, and answer technical and control-related questions with accuracy and judgment
• Own and continuously improve responses to customer vendor security questionnaires, RFPs, SIG/CAIQ-style assessments, and due-diligence requests; maintain a reusable knowledge base of control narratives grounded in how SpaceXSI actually operates
• Build and maintain working fluency across the SpaceXSI environment — AI/LLM systems and model governance, CI/CD pipelines, identity and access management, DevOps and DevSecOps practices, Kubernetes platforms, and governance of IT and AI environments — sufficient to answer customer questions and elevate appropriately to engineering when needed
• Partner with Engineering, Security, Legal, and Product to keep questionnaire content, Trust Center materials, and security collateral current as architecture, controls, and certifications evolve
• Translate customer security requirements into actionable internal asks; help distinguish must-have contractual or control commitments from unreasonable or out-of-scope demands
• Contribute to policies, standards, and procedures related to third-party risk, customer assurance, and vendor security due diligence
• Coordinate with the broader GRC and security teams on overlapping frameworks and evidence (e.g., SOC 2, ISO 27001, ISO 42001, privacy commitments) so external answers remain consistent with our internal control environment and GRC tooling (e.g., Vanta)
• Identify patterns in customer questionnaires and deal blockers; feed those insights back into product, engineering, and GRC roadmaps to reduce friction over time
• Create and present concise status updates on questionnaire volume, deal-impacting security asks, vendor risk posture, and emerging customer assurance themes to sales leadership and GRC stakeholders
• Champion clear, honest customer communication — building trust by explaining what we do, how we govern AI and infrastructure, and where we are intentionally scoping risk

Benefits

• Health and wellness: Comprehensive health insurance including medical, dental, vision, and disability coverage
• Life and family: Life and AD&D insurance and fertility benefits to ensure our team’s well-being and peace of mind
• Flexible vacation: We work hard but avoid burn out. Take time off when you need it
• Visa sponsorship: We support international talent with visa sponsorship to join our team
• 401(k) plan: Retirement savings plan to secure your financial future

The ideal candidate brings a cybersecurity and GRC perspective — fluent in how AI LLMs, CI/CD pipelines, identity and access management, DevOps, DevSecOps, Kubernetes, and IT/AI governance actually work in production — and can translate that understanding into clear, credible answers for enterprise buyers without slowing deals or overstating our postureStrong written and verbal communication skills, with the ability to explain cybersecurity and GRC concepts to sales, customers, legal, and engineering audiencesBachelor’s degree in computer science, Information Security, Cybersecurity, or in an engineering/STEM fieldDemonstrated experience completing or owning customer vendor security questionnaires and participating in security due-diligence discussions with enterprise buyersSolid understanding of common security and compliance frameworks used in customer assurance (e.g., SOC 2, ISO 27001, NIST CSF) and how controls map to questionnaire language5+ years of experience in cybersecurity, GRC, third-party risk management, security assurance, or a closely related role with customer-facing or sales-adjacent responsibilitiesWorking technical fluency across several of the following: AI/LLM or ML platforms, CI/CD pipelines, identity and access management, DevOps/DevSecOps, Kubernetes, and cloud environments (AWS, GCP, or Azure) — enough to understand control implications and speak credibly with engineers and customers7+ years of cybersecurity, GRC, third-party risk, or customer trust / security assurance experience (mid-to-senior scope)Prior experience in a presales security, solutions engineering (security), customer trust, or sales-enablement GRC role at a technology, cloud, or AI companyHands-on or deeply adjacent experience with vendor risk management programs — onboarding assessments, continuous monitoring, contract security exhibits, and residual-risk reportingFamiliarity with AI governance topics relevant to customer diligence (e.g., model data handling, prompt/output controls, training-data boundaries, ISO 42001 / NIST AI RMF concepts, EU AI Act awareness)Experience maintaining a Trust Center, security FAQ library, or questionnaire knowledge base; familiarity with GRC platforms such as Vanta, Drata, or similar is a plusAbility to read architecture diagrams, IAM models, and pipeline/Kubernetes high-level designs and turn them into accurate, non-jargon customer narrativesComfort operating in fast-moving deal cycles while protecting accuracy — knowing when to say “I’ll confirm with engineering” versus answering from established evidenceWorking knowledge of data privacy frameworks (e.g., GDPR, CCPA) as they appear in enterprise security and vendor assessmentsCertifications such as CISSP, CISA, CISM, CRISC, CTPRP, CIPT, CIPP/US, or similar preferredExperience supporting public sector, financial services, or other highly regulated customer diligence processes is a plusTo conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State