GRC Security Engineer: AI Governance & Frameworks

xAI; Washington (District of Columbia); On-site; USD 152,000 - 258,000; Full time

Benefits offered by this job

Equity

Medical, Vision & Dental coverage

401(k) retirement plan

Short & long-term disability insurance

Life insurance

Job summary

SpaceXAI seeks an experienced GRC Engineer to own and scale security and AI governance compliance as the company grows. You will design controls, implement policy‑as‑code, and automate evidence pipelines, collaborating with engineering, legal, product, and leadership to keep audit readiness across enterprise, commercial, and public‑sector environments.

The role emphasizes translating requirements into technical controls, embedding compliance in architecture and CI/CD, and fostering a culture of

Qualifications

• Bachelor's degree in computer science, Information Security, Cybersecurity, or in an engineering/STEM field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands‑on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert‑level working knowledge of several frameworks: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001.
• Experience with Compliance‑as‑Code practices and GRC automation tooling (e.g., Vanta, Drata, or similar).
• Ability to evaluate control objectives against real IT and cloud configurations and to work alongside engineers on remediation.

Responsibilities

• Own and execute security compliance implementation and audits across core frameworks including SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act, including control design, mapping, gap assessment, evidence collection, and remediation tracking.
• Build and maintain Compliance‑as‑Code and continuous compliance capabilities — policy‑as‑code, automated control validation, continuous evidence pipelines, and monitoring integrated into development and deployment workflows.
• Operate and extend GRC platforms (e.g., Vanta) as the system of record for controls, evidence, and audit readiness; integrate them with cloud, identity, and engineering tooling to reduce manual toil.
• Partner with engineering and architecture to embed compliance requirements early in design reviews; translate framework obligations into clear technical control narratives that satisfy auditors without slowing delivery.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures that support the company's governance and AI management system posture.
• Identify, assess, and prioritize risks related to AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments; distinguish meaningful business risk from compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with particular attention to AI system risks (data handling, model governance, agentic and conversational surfaces).
• Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; serve as the bridge between auditors and internal teams so requests are reasonable, clear, and relevant to our stack.
• Champion a culture of security and compliance across the company — educating teams on why controls exist, not only enforcing them.

Skills

GRC engineering

Security compliance

Cloud security

CI/CD integration

Communication

NIST CSF

SOC 2

ISO 27001

ISO 42001

Education

BS in CS/IS/Cybersecurity or Engineering

Tools

Vanta

Drata

Job description

SpaceXAI seeks an experienced GRC Engineer to own and scale security and AI governance compliance as the company grows. You will design controls, implement policy‑as‑code, and automate evidence pipelines, collaborating with engineering, legal, product, and leadership to keep audit readiness across enterprise, commercial, and public‑sector environments.

The role emphasizes translating requirements into technical controls, embedding compliance in architecture and CI/CD, and fostering a culture of