Governance, Risk & Compliance Analyst

Chaos Industries; El Segundo (CA); On-site; USD 120,000 - 165,000; Full time

Benefits offered by this job

Generous stock option grants

Relocation assistance

Annual bonuses (coming soon)

Free daily lunch

Job summary

CHAOS Industries seeks a senior GRC leader to own and mature its cybersecurity governance, risk, and compliance program. You will establish policies, standards, and accountability across IT, Cybersecurity, Physical Security, and Manufacturing, translating broad requirements into actionable controls.

You will design a unified control framework with security-by-design principles and defined MTD/RPO/RTO for critical systems, while coordinating audits and stakeholder reporting to drive security

Qualifications

• 5+ years hands-on GRC or compliance experience, including DoD environment or military service.
• Familiarity with NIST CSF, NIST RMF, ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53.
• Experience supporting third-party audits from evidence collection through closure.
• Experience designing controls tailored to an organization, not generic templates.
• Experience building risk registers, control frameworks, or compliance programs.
• Experience writing policy documentation for non-security audiences.
• Must have experience managing teams.

Responsibilities

• Own and mature CHAOS Industries cybersecurity GRC program with governance, policies, standards, and accountability across CHAOS businesses.
• Translate broad requirements into controls adopted by teams across IT, Cybersecurity, Physical Security, and Manufacturing.
• Build and manage cybersecurity risk processes: risk registers, findings, remediation plans, ownership, escalation, and business acceptance.
• Design a unified control framework with security-by-design for systems, including MTD, RPO, and RTO definitions.
• Write and maintain policies beyond minimum compliance to raise security maturity.
• Manage GRC tooling and workflows to support risk assessments, control monitoring, and reporting.
• Coordinate third-party and certification audits, including evidence collection and auditor liaison.
• Collaborate across Legal, Compliance, and business leaders to drive security requirements to execution.
• Report risk posture and audit status to Program Director and executives.
• Support audits in cloud environments and across company sites.

Skills

GRC governance

Policy writing

Audit coordination

Risk assessment

NIST RMF/CSF

DoD/military experience

Education

Bachelor’s degree or equivalent in CS/cybersecurity

Tools

GRC tooling

Job description

• Own and mature the CHAOS Industries cybersecurity GRC program by establishing governance structure, policies, standards, expectations, and accountability across CHAOS businesses
• You’ll report to the IT/Cybersecurity Program Director and work daily with IT, Cybersecurity, Physical Security, and Manufacturing – teams with different priorities and vocabulary; therefore, you’ll spend real time translating broad requirements into controls people adopt
• Build and manage cybersecurity risk processes, including risk registers, findings, vulnerabilities, remediation plans, ownership, escalation, and business acceptance
• If you enjoy designing frameworks that fit the organization rather than forcing the organization to fit a template, and you want direct input into how a defense company governs risk, this is the seat
• Own risk assessments across several departments and maintain the centralized risk register
• Design and maintain a unified, original control framework tailored to CHAOS Industries’ operating environment, including a security-by-design approach to systems development and defined: Maximum Tolerable Downtime (MTD), Recovery Point Objective (RPO), and Recovery Time Objective (RTO) for critical systems
• Write and maintain policy that goes beyond minimum mandatory compliance, building genuine security maturity rather than satisfying the floor of any one requirement
• Manage GRC tooling and related workflows to support risk assessments, control monitoring, and reporting
• Prepare for, coordinate, and help run third-party and certification audits, including evidence collection, gap assessments, and auditor liaison
• Act as the connective tissue between different department to then develop security and compliance requirements for partner teams and drive them to execution
• Report regularly to the Program Director and executive stakeholders on risk posture, audit status, and program maturity
• Onsite presence required 4 days per week
• Travel: up to 25%, primarily to support Manufacturing and Physical Security control validation across company sites
• Physical demands: occasional access to manufacturing floor environments, including required PPE and periods of standing or walking during facility walkthroughs
• Support customer, vendor, supplier, and subcontractor cybersecurity risk management, including questionnaires, contract reviews, security expectations, and customer‑facing services
• Coordinate cybersecurity audits, assessments, evidence requests, customer reviews, and remediation tracking in partnership with Legal, Compliance, commercial teams, IT, and business leaders

Benefits

• Generous pre-IPO stock option grants, relocation assistance + (coming soon!) annual bonuses
• Free daily lunch, ‘No meeting Fridays’, unlimited PTO (for exempt employees), casual dress code
• Life, FSA, HSA, 401k (+ Company match), and more
• Medical, dental and vision benefits will be 100% paid for by the company

Minimum of 5 years hands-on GRC or compliance experience combined with prior experience in a DoD environment or military serviceFamiliarity with OT/ICS security conceptsDeep knowledge of NIST CSF, NIST RMF, the ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53Has directly supported a third-party or certification audit from evidence collection through closureExposure to widely recognized governance, risk, and compliance frameworks spanning security, privacy, and quality management domainsBachelor’s degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field, or equivalent practical experienceHas performed or directly supported a formal risk assessment (identification, scoring, and treatment) using a defined methodologyCan apply recognized governance, risk, and compliance frameworks well enough to design real, working controls tailored to a specific organization, not just describe them genericallyExperience selecting, implementing, or administering GRC tooling and workflowsExperience supporting third-party audits in a cloud-centric environmentHas built or materially contributed to a risk register, control framework, or compliance program, not only operated within one already established elsewhereHas written policy or procedure documentation that a non-security audience could follow and act onMust have experience managing teams