Head of GRC & Compliance for Aerospace

Apex; Los Angeles (CA); On-site; USD 200,000 - 250,000; Full time

Benefits offered by this job

Equity in Apex

100% company-paid health coverage

PTO 15-20 days + holidays

401(k) matching

Parental leave (8 weeks)

Job summary

Apex seeks a Director, Governance, Risk & Compliance to own the GRC program end-to-end, directing control frameworks, risk management, audits, and evidence collection across NIST SP 800-171, CMMC, FedRAMP, SOC 2, ISO 27001. You will lead an ISSO and ISSM, align security, legal, engineering, IT and programs, and report upward.

You will build a scalable, centralized control framework, oversee vendor risk, and drive remediation while communicating regulatory status and business risk to executives.

Qualifications

• 8+ years in governance, risk, and compliance or information security.
• Experience owning a GRC or security compliance program.
• Strong cross-functional communication with regulators, auditors, engineers, and executives.

Responsibilities

• Own Apex's GRC program end-to-end: control frameworks, policies, standards, and procedures.
• Lead, manage, and mentor the GRC team, incl. ISSO/ISSM; set priorities and ownership.
• Drive compliance against government/defense requirements (NIST SP 800-171, CMMC, FedRAMP) and commercial certifications (SOC 2, ISO 27001).
• Partner with Legal/Trade on export controls and GDPR/CCPA obligations; map controls to regulatory requirements.
• Build and run enterprise risk management: maintain risk register, drive remediation, report residual risk.

Skills

GRC leadership

Regulatory knowledge

Cross-functional communication

U.S. Person status

Education

J.D./Masters in public policy

Job description

Apex seeks a Director, Governance, Risk & Compliance to own the GRC program end-to-end, directing control frameworks, risk management, audits, and evidence collection across NIST SP 800-171, CMMC, FedRAMP, SOC 2, ISO 27001. You will lead an ISSO and ISSM, align security, legal, engineering, IT and programs, and report upward.

You will build a scalable, centralized control framework, oversee vendor risk, and drive remediation while communicating regulatory status and business risk to executives.