Director, Governance, Risk & Compliance

Apex Technology, Inc.; Los Angeles (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Equity in Apex

Company-paid healthcare

PTO 15–20 days + holidays

401(k) matching

Parental leave

Lunch and snacks

Office Playa Vista

Career development opportunities

Job summary

Apex Technology, Inc. is seeking a Director, Governance, Risk & Compliance to own and scale the GRC program across the company.

You will lead a small team including ISSO/ISSM, set priorities, and ensure continuous authorization and evidence for regulatory frameworks. You will collaborate with Legal, IT, Engineering, and program teams to align NIST, FedRAMP, SOC 2, ISO 27001, ITAR/EAR, GDPR/CCPA requirements into a single, maintainable program that supports Apex's growth and customers in

Qualifications

• 8+ years in governance, risk, and compliance, information security.
• Experience leading and mentoring security staff.
• Deep knowledge of NIST SP 800-171 and NIST CSF/800-53; with CMMC and/or FedRAMP experience.
• Proven ownership of commercial security certifications — SOC 2 and/or ISO 27001.
• Familiarity with export control (ITAR/EAR) and data privacy obligations (GDPR/CCPA).
• Proven ability to manage audits and assessments end to end and build evidence.
• Strong cross-functional communication between regulators, auditors, engineers, and executives.
• U.S. Person status is required.

Responsibilities

• Own GRC program end to end, establishing and maintaining control frameworks, policies, standards, and procedures.
• Lead, manage, and mentor the GRC team; set priorities and grow capabilities as the program scales.
• Drive compliance against government and defense requirements — NIST SP 800-171, CMMC, FedRAMP; SSP and POA&M development, control implementation, and audits.
• Own the SOC 2 Type II and ISO 27001 roadmap; manage scoping, evidence collection, and audits.
• Partner with Legal and Trade Compliance on ITAR/EAR and with Privacy on GDPR/CCPA obligations.
• Build and run the enterprise risk management process and report residual risk to leadership.
• Manage the full audit and assessment lifecycle; be primary point of contact for evidence and corrective actions.
• Establish a centralized control framework to satisfy multiple regulatory obligations.
• Run vendor and third-party risk programs; assess suppliers against Apex's security requirements.
• Deliver decision-ready reporting on compliance status, risk posture, and audit outcomes.

Skills

GRC leadership

Team management

NIST SP 800-171

CMMC knowledge

Security audits

SOC 2 knowledge

ISO 27001 knowledge

Export controls (ITAR/EAR)

GDPR/CCPA knowledge

Cross-functional communication

U.S. Person status

Education

J.D. or MPP degree

Job description

Spacecraft represent the most pressing unmet need across the entire aerospace industry. As more launch vehicles come online and the cost to orbit decreases, more companies launching payloads to space continue to emerge.

For the first time in history, this influx of payload companies combined with reduced launch costs has resulted in a massive increase in need for commercial spacecraft platforms, known as satellite buses. These buses hold the payloads of our customers and are flown on launch vehicles.

Apex manufactures these satellite buses at scale using a combination of software, vertical integration, and hardware that is designed for manufacturing. Our spacecraft enable the future of society: ranging from earth observation to communications and more.

We’d love for you to join us on our mission of providing humankind access to the galaxy beyond our planet.

About the Role

We are hiring a Director, Governance, Risk & Compliance (GRC) to own that posture end to end and build the function that keeps Apex audit-ready across every framework our business depends on.

This is a player-coach leadership role. You will personally own our GRC program — control frameworks, risk management, audits, assessments, and the body of evidence that proves our compliance — while building and leading the team that sustains it. You will directly manage an Information System Security Officer (ISSO) and Information System Security Manager (ISSM), setting their priorities, developing their careers, and holding the line on the standards our authorizations and certifications require.

You will report to the Director of Cybersecurity and serve as the connective tissue between security, legal, engineering, IT, and program teams. Apex operates across government/defense (NIST SP 800-171, CMMC, FedRAMP), commercial security (SOC 2, ISO 27001), export and trade control (ITAR/EAR), and data privacy (GDPR, CCPA) — this role sees all of it and is accountable for turning that patchwork of obligations into a single, coherent, continuously-maintained program.

Responsibilities

• Own Apex's GRC program end to end, establish and maintain the control frameworks, policies, standards, and procedures that govern how the company secures its systems and data.

• Lead, manage, and mentor the GRC team, including a direct-report ISSO and ISSM; set priorities, define ownership, and grow the team's capability as the program scales.

• Drive compliance against government and defense requirements — NIST SP 800-171, CMMC, and FedRAMP — including SSP and POA&M development, control implementation, continuous monitoring, and audit/assessment readiness.

• Own the commercial security certification roadmap (SOC 2 Type II, ISO 27001), managing scoping, evidence collection, auditor relationships, and remediation to certification and renewal.

• Partner with Legal and Trade Compliance on export control (ITAR/EAR) and with Privacy stakeholders on GDPR/CCPA obligations, ensuring technical and administrative controls map cleanly to regulatory requirements.

• Build and run the enterprise risk management process: maintain the risk register, lead risk assessments, drive remediation to closure, and report residual risk to leadership in terms the business can act on.

• Manage the full audit and assessment lifecycle — internal, customer, and third-party — serving as the primary point of contact and owning the evidence, narratives, and corrective actions.

• Establish and maintain a centralized control framework that de-duplicates overlapping requirements across regimes, so a single set of controls satisfies many obligations.

• Run the vendor and third-party risk program, assessing suppliers and partners against Apex's security and compliance requirements.

• Deliver clear, decision-ready reporting to the Director of Cybersecurity and executive stakeholders on compliance status, risk posture, and audit outcomes.

Requirements

• 8+ years in governance, risk, and compliance, information security, or a closely related field, including direct experience owning a GRC or security compliance program.

• Experience leading and managing people — you have built, managed, or mentored security/compliance staff and are ready to own an ISSO and ISSM as direct reports.

• Deep, hands-on knowledge of NIST SP 800-171 and the NIST frameworks (800-53, RMF/CSF), with practical experience in CMMC and/or FedRAMP authorization work.

• Demonstrated ownership of commercial security certifications — SOC 2 and/or ISO 27001 — from scoping through audit and certification.

• Working familiarity with export control (ITAR/EAR) and data privacy (GDPR, CCPA) obligations, and how they translate into technical and administrative controls.

• Proven ability to manage audits and assessments end to end and to build the evidence and documentation that withstands external scrutiny.

• Strong cross-functional communication skills — able to translate between regulators, auditors, engineers, and executives without losing precision.

• U.S. Person status is required as this position needs to access export-controlled data.

Nice-to-Haves

• J.D. law degree or master's degree in public policy

• Experience in aerospace, defense, space, or another regulated hardware/manufacturing environment.

• Active or prior U.S. government security clearance.

• Relevant certifications such as CISSP, CISM, CRISC, CISA, or CCSP.

• Experience standing up a GRC program or control framework from the ground up in a high-growth company.

• Familiarity with GRC tooling and automated evidence-collection / continuous-monitoring platforms.

• Experience building compliance for a product or platform that is itself sold or licensed to customers.

#LI-JC1

Why Join Apex?

Apex believes in creating a work environment that you look forward to embracing every day. Our employees love working at Apex, and we want you to love it too. We're a fast-growing startup that has raised more than $500M in funding, and we invest heavily in our people from day one.

What We Offer For Full-time Employees:

• Shared upside: Receive equity in Apex, letting you benefit from the work you create

• Best-in-class healthcare: 100% company-paid medical, dental, and vision for you and your dependents, plus $100k life insurance at no cost

• Comprehensive PTO package: Starting at 15 days vacation, growing to 20+ days annually, plus 10 paid holidays

• Competitive 401(k) plan: Generous matching - 100% match on first 3%, 50% on next 2%

• 8 weeks paid parental leave: Plus childcare reimbursement up to $350/day for work-related travel

• Daily catered lunch and unlimited snacks: To keep you fueled throughout the day

• Vibrant community: Monthly office socials, pickleball tournaments, run club, and gatherings for you and your family

• Your dream desk setup: All the tools you need to be your most productive self

• World-class Playa Vista office: With the benefit of in-person collaboration with amazing coworkers and flexibility to integrate work and life

• Real impact opportunity: Work alongside experts from aerospace, new space, and other cutting-edge industries to make a lasting difference

Additional Information:

Compensation ranges are set by role, level, location, and alignment with market data. A candidate's specific level and base pay are determined case by case and may vary with job-related skills, education, experience, technical capabilities, and internal equity. Beyond base salary, full-time hires are also eligible for long-term incentives in the form of stock options, along with medical, dental, and vision coverage and a 401(k) retirement plan.

ITAR Requirements

Apex's work is governed by U.S. export control laws, including the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). To be eligible for this role, applicants must either (1) qualify as a U.S. Person, meaning a U.S. citizen or national, a lawful permanent resident (green card holder), a refugee admitted under 8 U.S.C. § 1157, or an individual granted asylum under 8 U.S.C. § 1158, or (2) be able to obtain the required export authorizations from the U.S. Department of State, the U.S. Department of Commerce, or another applicable U.S. government agency. You can learn more about ITAR here.

Equal Opportunity Employer

Apex Technology, Inc. is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Candidates and employees are always evaluated based on merit, qualifications, and performance. We will never discriminate on the basis of race, color, gender, national origin, ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability, or any other legally protected status.