GRC Director - Aerospace Compliance & Risk

Apex Space, Inc.; Los Angeles (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Equity

Healthcare coverage

PTO package

401(k) plan

Parental leave

Lunch provided

Office in Playa Vista

Impact at work

Job summary

Apex Space, Inc. is seeking a Director of Governance, Risk & Compliance to own the GRC program end to end. You will lead a team including ISSO/ISSM, manage frameworks, risk, audits, and certifications, and partner with Legal, IT, and Privacy to align regulatory requirements.

The role reports to the Director of Cybersecurity and requires U.S. Person status for export-controlled data access, with a focus on transforming obligations into a coherent, maintained program.

Qualifications

• 8+ years in governance, risk, and compliance, information security, or a closely related field.
• Experience leading and managing people — you have built, managed, or mentored security/compliance staff and are ready to own an ISSO and ISSM as direct reports.
• Deep, hands-on knowledge of NIST SP 800-171 and the NIST frameworks (800-53, RMF/CSF), with practical experience in CMMC and/or FedRAMP authorization work.
• Demonstrated ownership of commercial security certifications — SOC 2 and/or ISO 27001 — from scoping through audit and certification.
• Working familiarity with export control (ITAR/EAR) and data privacy (GDPR, CCPA) obligations, and how they translate into technical and administrative controls.
• Proven ability to manage audits and assessments end to end and to build the evidence and documentation that withstands external scrutiny.
• Strong cross-functional communication skills — able to translate between regulators, auditors, engineers, and executives without losing precision.
• U.S. Person status is required as this position needs to access export-controlled data.

Responsibilities

• Own Apex's GRC program end to end, establish and maintain the control frameworks, policies, standards, and procedures that govern how the company secures its systems and data.
• Lead, manage, and mentor the GRC team, including a direct-report ISSO and ISSM; set priorities, define ownership, and grow the team's capability as the program scales.
• Drive compliance against government and defense requirements — NIST SP 800-171, CMMC, and FedRAMP — including SSP and POA&M development, control implementation, continuous monitoring, and audit/assessment readiness.
• Own the commercial security certification roadmap (SOC 2 Type II, ISO 27001), managing scoping, evidence collection, auditor relationships, and remediation to certification and renewal.
• Partner with Legal and Trade Compliance on export control (ITAR/EAR) and with Privacy stakeholders on GDPR/CCPA obligations, ensuring technical and administrative controls map cleanly to regulatory requirements.
• Build and run the enterprise risk management process: maintain the risk register, lead risk assessments, drive remediation to closure, and report residual risk to leadership in terms the business can act on.
• Manage the full audit and assessment lifecycle — internal, customer, and third-party — serving as the primary point of contact and owning the evidence, narratives, and corrective actions.
• Establish and maintain a centralized control framework that de-duplicates overlapping requirements across regimes, so a single set of controls satisfies many obligations.
• Run the vendor and third-party risk program, assessing suppliers and partners against Apex's security and compliance requirements.
• Deliver clear, decision-ready reporting to the Director of Cybersecurity and executive stakeholders on compliance status, risk posture, and audit outcomes.

Skills

GRC leadership

risk management

regulatory compliance

NIST SP 800-171

SOC 2

ISO 27001

cross-functional comms

leadership

US Person status

Education

Bachelor's degree in a relevant field

J.D. or public policy degree

Tools

GRC tooling

evidence-collection platforms

continuous-monitoring

Job description

Apex Space, Inc. is seeking a Director of Governance, Risk & Compliance to own the GRC program end to end. You will lead a team including ISSO/ISSM, manage frameworks, risk, audits, and certifications, and partner with Legal, IT, and Privacy to align regulatory requirements.

The role reports to the Director of Cybersecurity and requires U.S. Person status for export-controlled data access, with a focus on transforming obligations into a coherent, maintained program.