GRC Security Engineer – Regulated Manufacturing

AirLife; Grand Rapids (MI); On-site; USD 90,000 - 140,000; Full time

Benefits offered by this job

medical coverage

dental coverage

vision coverage

401(k)

paid time off

paid holidays

bereavement leave

Employee Assistance Program resources

medical leave benefits

bonus

commission

other incentive compensation

Job summary

AirLife is seeking a Security Engineer – Governance, Risk & Compliance to mature the company’s information security posture in a medical device manufacturing environment. You will lead risk assessments, develop policies, and coordinate with QA/RA and Legal on regulatory obligations including FDA and ISO standards.

You will manage vulnerability programs, security training (KnowBe4), and coordinate with MDR/MSSP providers, aiming to align with external auditors and insurers.

Qualifications

• Strong knowledge of risk management frameworks: NIST CSF, NIST 800-30/37, ISO 27001, CIS Controls.
• Understanding regulatory compliance for medical device manufacturing (FDA 21 CFR Part 820 / QMSR, ISO 13485) and ITGC.
• Experience with IT General Controls and SOX-adjacent controls in PE-backed manufacturing.
• Knowledge of data privacy regulations (GDPR, US state laws) and IT implications.
• Experience conducting risk assessments and gap analyses; document findings and remediation.
• Developing and maintaining security policies, standards, procedures, and evidence libraries.
• Familiarity with vulnerability management programs and remediation tracking.
• Experience administering security awareness training (KnowBe4 preferred).
• Ability to work with MDR/MSSP providers to align with compliance posture (Arctic Wolf a plus).
• Strong written communication; document findings and present risk to executives/auditors.
• Proficiency with project and task management tools; Smartsheet preferred.
• Industry-recognized GRC or cybersecurity certifications preferred (CISA, CRISC, CompTIA Security+, SSCP).

Responsibilities

• Develop, implement, and maintain information security policies and procedures.
• Conduct security risk assessments and gap analyses across IT and operational technology.
• Own AirLife's security compliance posture across NIST CSF, CIS Controls, ISO 27001, GDPR.
• Support ITGC compliance: access reviews, change management, audit evidence.
• Coordinate IT security controls with QA/RA and Legal & Compliance for 21 CFR Part 820/QMSR and ISO 13485.
• Administer security awareness training; plan KnowBe4 campaigns and track completion.
• Maintain vulnerability management program; track remediation and trends.
• Support benchmarking with Frazier Partners and insurance assessment prep.
• Collaborate with Arctic Wolf and MSSPs to align services with compliance posture.
• Maintain Incident Response Playbook; assist in tabletop exercises.
• SME for audits; prepare evidence and manage remediation.
• Build and maintain GRC docs: risk register, control matrix, policy library.

Skills

Security risk mgmt

Regulatory compliance

ITGC

Data privacy

Risk assessments

Policies & procedures

Vulnerability management

Security awareness

MDR/MSSP coordination

Technical writing

Project management

Security certifications

Education

Bachelor's degree in Cybersecurity/IT/CS or related

Tools

KnowBe4

Smartsheet

Arctic Wolf

Job description

AirLife is seeking a Security Engineer – Governance, Risk & Compliance to mature the company’s information security posture in a medical device manufacturing environment. You will lead risk assessments, develop policies, and coordinate with QA/RA and Legal on regulatory obligations including FDA and ISO standards.

You will manage vulnerability programs, security training (KnowBe4), and coordinate with MDR/MSSP providers, aiming to align with external auditors and insurers.