GRC Lead

Voyager Technologies, Inc.; Denver (CO); Remote; USD 140,000 - 185,000; Full time

Benefits offered by this job

Flexible Time Off

Medical/Dental/Vision

Gym memberships

401(k) match

Wellness programs

Job summary

Voyager Technologies, Inc. is seeking a GRC Lead to own and mature the Governance, Risk, and Compliance program, including CMMC.

This remote role reports to the Senior Director of Cybersecurity and works across IT, engineering, legal, and operations to embed compliance into processes. The successful candidate will manage control mappings, evidence libraries, audits, and risk assessments, and drive remediation.

Qualifications

• Bachelor's degree in information security or related field with 8 years of GRC experience OR Master's with 6 years.
• Certifications such as CISSP, CISA, CRISC, CISM, or CompTIA Security+.
• Hands-on CMMC (Level 2/3) or NIST SP 800-171 implementation/assessment.
• Experience mapping controls, evidence collection, and remediation.
• Experience drafting security policies and procedures.
• Audit support including evidence prep and auditor coordination.
• Independent work style with cross-functional collaboration.
• Strong communication skills for technical and non-technical audiences.

Responsibilities

• Own the end-to-end GRC program, governance frameworks, risk processes, and compliance activities (CMMC, NIST 800-171, FAR/DFARS).
• Lead CMMC readiness including scoping, gap assessments, POA&M, and coordination with the C3PAO.
• Manage control framework mapping, ownership, evidence collection, and remediation of gaps.
• Build and maintain the evidence library; ensure artifacts are audit-ready.
• Plan and support internal/external audits and third-party reviews; primary auditor liaison.
• Maintain organizational risk register; facilitate risk assessments and track treatment.
• Partner with IT, engineering, legal, and operations to embed compliance into processes.
• Track regulatory landscape and advise leadership on changes.

Skills

GRC management

CMMC experience

Policy drafting

Audit support

Risk management

Stakeholder coordination

CMMC readiness

Education

Bachelor's in information security

Master's in information security

Job description

GRC Lead

Voyager is an innovative space, defense, and national security technology company committed to advancing and delivering transformative, mission-critical solutions. We tackle the most complex challenges to unlock new frontiers for human progress, fortify national security, and protect critical assets to lead in the race for technological and operational superiority from ground to space.

Forge the Future: Join Voyager Technologies

The future belongs to those who build it. At Voyager Technologies, were building technologies that protect lives, expand frontiers and prepare us for whats next. And were doing that with people who are wired to solve, build, adapt and lead. These roles are not for the faint of heart.

Youll help lay the foundation for humanity's future. Join a culture where innovation thrives, curiosity is rewarded, and impact is real. Were a company of doers, thinkers and builders, united by purpose and grounded in reality.

If you want to put your skills to work where the stakes are real and the mission is bigger than any one person, forge the future with Voyager.

The GRC Lead for cybersecurity is responsible for owning and maturing our Governance, Risk, and Compliance program, including CMMC.

The position reports to the Senior Director of Cybersecurity and is part of the IT department. This role is remote.

In this role, the essential functions are:

• Own the end-to-end GRC program, including governance frameworks, risk management processes, and compliance activities across applicable regulatory and contractual requirements (CMMC, NIST 800-171, FAR/DFARS, and others as applicable)


• Lead CMMC readiness efforts including scoping, gap assessments, POA&M development, and coordination with the C3PAO through assessment


• Manage the control framework mapping controls to applicable standards, tracking control ownership, and driving remediation of gaps


• Build and maintain the evidence library; define evidence collection processes and ensure artifacts are accurate, complete, and audit-ready


• Plan and support internal and external audits, assessments, and third-party reviews; serve as the primary point of contact for auditors


• Conduct and maintain the organizational risk register; facilitate risk assessments and track risk treatment decisions to closure


• Partner with IT, engineering, legal, and operations to embed compliance requirements into processes, tools, and projects


• Track the regulatory and compliance landscape for changes relevant to the business and advise leadership accordingly

Minimum Qualifications:

• Bachelors degree in information security or other related field with 8 years of experience in GRC, information security compliance, or other related field OR Masters degree in information security or other related field with 6 years of experience


• Relevant certification such as CISSP, CISA, CRISC, CISM, or CompTIA Security+


• Direct, hands-on experience with CMMC (Level 2 or Level 3) or NIST SP 800-171 implementation and assessment preparation.


• Demonstrated ability to manage a control framework mapping, ownership assignment, evidence collection, and gap remediation.


• Experience drafting and maintaining information security policies and procedures.


• Proven track record supporting audits or third-party assessments, including evidence preparation and auditor coordination.


• Ability to work independently, manage multiple workstreams, and drive cross-functional stakeholders without direct authority.


• Excellent written and verbal communication skills, including the ability to translate technical compliance requirements for non-technical audiences.

Preferred Qualifications:

• CMMC assessor certification such as CCP, CCA, or LCCA.


• Prior experience building or maturing a GRC program from an early stage.


• Background coordinating with C3PAOs or DCSA assessors.

Travel, Physical, and/or Government Mandated Requirements:

• Travel may be required to Voyager facilities, operational sites, and partner locations.


• Participation in security exercises, incident response, or time-sensitive remediation activities may occasionally be required outside normal business hours.


• This position requires access to information governed by U.S. export-control laws and may require access to government-controlled systems or data.

The good faith base salary range for this role is $140,000 $185,000 at the time of this posting. Where you fall within the range depends on your experience, skills, and location. This range reflects base salary only and does not include benefits or bonus/incentive. This range may be adjusted in the future.

Voyager offers a highly competitive total compensation package designed to support the well-being, growth, and success of our employees. Employees benefit from a flexible and comprehensive rewards program that supports both professional and personal well-being.

• Flexible Time Off (FTO), empowering employees to take the time they need to recharge and maintain a healthy work-life balance


• Comprehensive medical, dental, and vision coverage for employees and their families, with a significant portion of premiums covered by the company and many benefits paid at 100% for employees


• Flexible, affordable gym memberships with 12,700+ options nationwide, including 24 Hour Fitness, EoS Fitness, Crunch Fitness, Anytime Fitness, Blink Fitness, Chuze Fitness, and more! No long-term contracts and FREE on-demand workout videos before you enroll


• 401(k) retirement plan with a 50% company match on contributions up to 8%, supporting long-term financial security


• Company wellness programs that support physical and mental well-being


• Additional voluntary benefits and employee support resources


• The opportunity to work alongside a highly talented team in an innovative, mission-driven environment

Voyager is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status, or other characteristics protected by law.

To conform to U.S. Government export regulations, including the International Traffic in Arms Regulations (ITAR) (22 CFR Parts 120130) and the Export Administration Regulations (EAR) (15 CFR Parts 730774), applicants for this position must be a U.S. Person: a US Citizen, a lawful permanent resident of the U.S., or a protected individual as defined by 8 U.S.C. 1324b(a)(3). Applicants must be eligible to obtain any required export authorizations from the U.S. Department of State or the U.S. Department of Commerce.

Minority/Female/Disabled/Veteran

The statements contained in this job description are intended to describe the general content and requirements for performance of this job. It is not intended to be an exhaustive list of all job duties, responsibilities, and requirements. This job description is not an employment agreement or contract. Management has the exclusive right to alter the scope of work within the framework of this job description at any time without prior notice.

Remote - United States pay range

Equal employment opportunity, including veterans and individuals with disabilities.