GRC Lead: Cyber Risk & Compliance (Defense Tech)

chaosindustries; Washington (District of Columbia); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health benefits (medical, dental, &amp

401k matching

Job summary

CHAOS Industries is seeking a seasoned security professional to own and mature the GRC program across the organization. You will establish governance, policies, and standards while translating broad requirements into actionable controls for IT, Cybersecurity, and Manufacturing teams.

You will design a unified control framework, manage risk processes including risk registers, audit readiness, and remediation, and report to executive stakeholders on risk posture and program maturity.

Qualifications

• Bachelor's degree or equivalent in computer science, information security, or related field.
• Deep knowledge of NIST CSF, RMF, ISO/IEC 27000 series and DoD/NIST 800-171.
• Experience selecting or administering GRC tooling and workflows.
• Exposure to governance, risk, and compliance frameworks.
• Familiarity with OT/ICS security concepts.
• 5+ years in GRC/compliance with DoD experience.

Responsibilities

• Own CHAOS Industries cybersecurity GRC program governance, policies, and standards.
• Manage risk processes including risk registers, findings, remediation plans, and escalation.
• Write policies beyond minimum compliance to mature security posture.
• Coordinate audits and evidence collection with cross‑functional teams.
• Build security requirements and controls aligned to the organization.
• Maintain centralized risk register and risk assessments across departments.
• Travel up to 25% and onsite presence 4 days/week.

Skills

GRC

NIST CSF

NIST RMF

ISO 27001

Policy writing

Audit coordination

DoD experience

Education

Bachelor's degree in CS/InfoSec

Tools

GRC tooling

Job description

CHAOS Industries is seeking a seasoned security professional to own and mature the GRC program across the organization. You will establish governance, policies, and standards while translating broad requirements into actionable controls for IT, Cybersecurity, and Manufacturing teams.

You will design a unified control framework, manage risk processes including risk registers, audit readiness, and remediation, and report to executive stakeholders on risk posture and program maturity.