GRC Lead: Space Tech Compliance & Risk

Northwood Space; El Segundo (CA); On-site; USD 150,000 - 230,000; Full time

Job summary

Northwood Space seeks a seasoned Governance, Risk & Compliance Lead to own the company’s compliance program across CMMC, FedRAMP, SOC 2 and ITAR. You will translate regulatory requirements into practical controls and work with security engineering, network and product teams to embed compliance into operations.

As the primary contact for government customers and assessors, you will manage SSPs, POA&Ms, risk registers, and audit readiness, while aligning control frameworks with NIST and ITAR/DFARS

Qualifications

• Senior GRC professional with deep regulatory knowledge and technical fluency.
• Ability to translate compliance requirements into operational controls.
• Experience across government and security environments.

Responsibilities

• Own Northwood's compliance program across CMMC Level 2, FedRAMP, SOC 2 Type II, and ITAR, including control mapping, gap assessment, remediation tracking, and audit preparation.
• Maintain SSP, POA&M, and related documentation per NIST 800-171/800-53 and applicable frameworks.
• Coordinate and manage third-party assessments and audits with 3PAOs and assessors.
• Monitor regulatory changes and assess impact on compliance posture.
• Lead risk management activities including risk registers, scoring, and executive reporting.
• Develop and maintain security policy library and control framework mappings across NIST, SOC 2, and FedRAMP.
• Oversee ITAR & CUI program management, data classification, handling procedures, and training.
• Ensure readiness for audits and engage with stakeholders across security, engineering, product, and operations.

Skills

GRC leadership

Regulatory compliance

ITAR compliance

FedRAMP

CMMC

SOC 2

Risk management

Policy development

Audit readiness

Job description

Northwood Space seeks a seasoned Governance, Risk & Compliance Lead to own the company’s compliance program across CMMC, FedRAMP, SOC 2 and ITAR. You will translate regulatory requirements into practical controls and work with security engineering, network and product teams to embed compliance into operations.

As the primary contact for government customers and assessors, you will manage SSPs, POA&Ms, risk registers, and audit readiness, while aligning control frameworks with NIST and ITAR/DFARS