Security Engineer-Governance, Risk & Compliance

Airlife; Deerfield (IL); On-site; USD 115,000 - 130,000; Full time

Benefits offered by this job

Medical, dental, vision benefits

401(k) plan

Job summary

AirLife is seeking a Security Engineer – Governance, Risk & Compliance to mature our information security risk program in a regulated medical device environment. You will drive GRC activities, manage audits, and partner with QA/RA to ensure FDA and ISO obligations are met.

The role requires 4–6 years in IT with 3+ years in cybersecurity focusing on GRC, risk management, and regulatory compliance. Travel up to 20% is required.

Qualifications

• Strong working knowledge of security risk management frameworks and methodologies (NIST CSF, NIST SP 800-30/37, ISO 27001, CIS Controls).
• Understanding regulatory compliance for medical device/manufacturing (FDA 21 CFR Part 820 / QMSR, ISO 13485) and ITGC implications.
• Experience with IT General Controls frameworks and audit support in PE-backed manufacturing contexts.
• Knowledge of data privacy regulations (GDPR, US state laws) and IT implications.
• Experience conducting risk assessments, gap analyses, and control remediation tracking.
• Ability to develop and maintain security policies, standards, and control libraries.
• Familiarity with vulnerability management programs, scanning tools, and remediation prioritization.
• Experience administering security awareness programs and phishing simulations (KnowBe4 preferred).
• Collaboration with MDR/MSSP providers to align security detections with compliance posture (Arctic Wolf a plus).
• Strong written communication for audit evidence and risk posture reporting.

Responsibilities

• Develop, implement, and maintain AirLife's information security policies, standards, and procedures.
• Conduct periodic security risk assessments and gap analyses across IT and OT, quantify risk, and recommend remediations.
• Own AirLife's security compliance posture across NIST CSF, CIS Controls, ISO 27001, GDPR; manage evidence and calendars.
• Support ITGC compliance, including access control reviews and change management documentation.
• Coordinate with QA/RA and Legal to align controls with 21 CFR Part 820 / QMSR and ISO 13485 obligations.
• Manage security awareness training programs, phishing simulations, and completion tracking.
• Maintain and improve vulnerability management; track remediation and report trends to IT leadership.
• Coordinate with external partners for cyber benchmarking and insurance assessments; supply requested security metrics.
• Collaborate with managed security providers to ensure services align with AirLife's compliance posture.
• Maintain IT security incident response playbooks and coordinate tabletop exercises; assist in post-incident reviews.
• Serve as SME for audits: prepare evidence, coordinate interviews, manage findings and remediation closures.

Skills

Security risk management

NIST CSF

ISO 27001

ITGC audits

Regulatory compliance

Policy development

Vulnerability management

Security awareness training

Audit evidence

Vendor management

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

KnowBe4

Smartsheet

Arctic Wolf

SOX controls

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Security Engineer-Governance, Risk & Compliance

Full Time Grand Rapids, Grand Rapids, MI, US

Salary Range: $115,000.00 To $130,000.00 Annually

COMPANY DESCRIPTION

At AirLife, we are dedicated to improving the quality of every breath. Excellence with Every Breath is not just a tag line, but the way we work and take care of our customers. With a mindset to evolve, innovate, and grow, we are a premier manufacturer of the highest-quality and market-leading breathing consumables. This growth philosophy has positioned us to increase our global footprint and business reach, impacting even more people around the world. Our expanding family of the most trusted brands offers a product portfolio that spans the continuum of care from first responder to home care, with safety, patient comfort, and clinical performance in mind. Collective expertise allows us to provide quality products and experiences to our patients, customers, and our people. Our values of Customer first, Differentiate with our People, Bias for Action, Continuous Improvement and Accountability define who we are and how we work. Join us!

POSITION SUMMARY

The Security Engineer – Governance, Risk & Compliance is responsible for establishing and maturing AirLife's information security risk management and compliance posture. This role evaluates, quantifies, and helps mitigate security risks across IT infrastructure and business systems, while ensuring AirLife's cybersecurity practices remain aligned to applicable regulatory frameworks, industry standards, and internal policies. Operating in a medical device manufacturing environment with FDA and ISO regulatory obligations and a PE ownership structure with specific cybersecurity reporting requirements, this role brings both technical security knowledge and a compliance mindset to a rapidly maturing IT security program. The Security Engineer – GRC plays a critical role in AirLife's ability to satisfy external auditors, insurance underwriters, and PE sponsor security benchmarking requirements.

POSITION QUALIFICATIONS

Knowledge, Skills & Abilities:

• Strong working knowledge of security risk management frameworks and methodologies, including NIST CSF, NIST SP 800-30/37, ISO 27001, and CIS Controls.
• Understanding of regulatory compliance requirements relevant to medical device manufacturing, including FDA 21 CFR Part 820 / QMSR and ISO 13485, and their implications for IT General Controls (ITGC) and computer system validation.
• Experience with IT General Controls frameworks and audit support, including SOX-adjacent controls applicable to PE-backed manufacturing companies.
• Knowledge of data privacy regulations, including GDPR and applicable US state privacy laws, and their operational IT implications.
• Experience conducting risk assessments, gap analyses, and security control reviews; ability to document, prioritize, and track findings through to remediation.
• Experience developing and maintaining security policies, standards, procedures, and control evidence libraries.
• Familiarity with vulnerability management programs, including scanning tooling, remediation tracking, and risk-based prioritization.
• Experience administering security awareness training programs, including phishing simulation and completion tracking (KnowBe4 experience preferred).
• Ability to work with MDR/MSSP providers to ensure managed detection capabilities align with AirLife's compliance posture (Arctic Wolf experience a plus).
• Strong written communication skills; ability to clearly document findings, prepare audit evidence packages, and present risk posture to non-technical audiences including executives and external auditors.
• Proficiency with project and task management tools; Smartsheet experience preferred.
• Industry-recognized GRC or cybersecurity certification(s) preferred (CISA, CRISC, CompTIA Security+, SSCP, or equivalent).

Level of Experience:

Minimum 4–6 years of IT experience with 3+ years in a cybersecurity role with a GRC, compliance, or risk management focus. Experience in a regulated manufacturing, medical device, or life sciences environment strongly preferred.

Level of Education:

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent experience. GRC-relevant certification(s) preferred.

Travel:

Up to 20% as required by the business.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Develop, implement, and maintain AirLife's information security policies, standards, and procedures, ensuring they remain current, compliant with applicable frameworks, and operationally effective for the teams they govern.
• Conduct and facilitate periodic security risk assessments and gap analyses across IT infrastructure, business applications, and operational technology, documenting findings, quantifying risk, and recommending prioritized remediation measures to IT leadership.
• Own AirLife's security compliance posture across applicable frameworks (NIST CSF, CIS Controls, ISO 27001, GDPR), including control documentation, evidence collection, ongoing compliance monitoring, and management of compliance calendars.
• Support IT General Controls (ITGC) compliance, including access control review coordination, change management process documentation, and preparation and management of audit evidence packages for internal and external auditors.
• Partner with QA/RA and Legal & Compliance to ensure IT security controls are appropriately aligned to AirLife's 21 CFR Part 820 / QMSR and ISO 13485 obligations, particularly as they relate to computer system validation and access control in regulated processes.
• Own and administer AirLife's security awareness and compliance training program, including planning and coordinating KnowBe4 phishing simulation and training campaigns, tracking completion rates across departments, and reporting to IT leadership on compliance status.
• Maintain and improve AirLife's vulnerability management program, including scheduling assessments, tracking and prioritizing remediation, and reporting vulnerability posture and trends to IT leadership.
• Support Frazier Partners' cybersecurity benchmarking and reporting requirements; coordinate with Lockton for cyber insurance assessment preparation and supply requested security metrics, documentation, and evidence as required.
• Collaborate with Arctic Wolf and other managed security service providers to ensure managed services are operating in alignment with AirLife's compliance posture, risk appetite, and applicable regulatory requirements.
• Maintain, test, and continuously improve the IT Cyber Incident Response Playbook; support the planning and facilitation of tabletop exercises; assist in incident response coordination and post-incident review when security events occur.
• Serve as the IT security subject matter expert for IT-related internal and external audits: prepare evidence packages, coordinate audit interviews, manage finding responses, and own remediation tracking through closure (including all enterprise applications and segregation-of-duties findings).
• Build and maintain a comprehensive GRC documentation library, including the risk register, control matrix, policy library, compliance calendar, and audit history, ensuring currency and accessibility for authorized stakeholders.

OTHER RESPONSIBILITIES

• Uphold and embody AirLife's values in all aspects of work.
• Demonstrate accuracy and thoroughness in daily work; look for ways to improve and promote quality & safety.
• Inspire the trust of others; treat people with respect and dignity and embrace the value of diversity.
• Use time efficiently; perform job accurately, thoroughly, and conserve Company resources to improve profits.
• Contribute to building and maintaining a positive team environment.
• Assure all policies and guidelines are implemented and followed.

QUALITY POLICY

At AirLife, Quality is our promise. It is our commitment to customer satisfaction and our dedication to product excellence in an evolving global healthcare market. This promise is kept through a continuously improving and effective Quality Management System and compliance to Regulatory Requirements.

DEIA STATEMENT

At AirLife, we are committed to building a diverse workforce and an inclusive workplace that reflects the communities and customers we serve. We believe our philosophy on Diversity, Equity, Inclusion, and Advancement (DEIA) encourages excellence and equips us to serve an evolving global marketplace.

Please note:

The responsibilities outlined above are not exhaustive and may evolve over time. The role holder may be required to undertake additional duties as reasonably expected to meet the needs of the company.

AirLife offers a comprehensive benefits package, including medical, dental, and vision coverage, 401(k), paid time off, paid holidays, bereavement leave, Employee Assistance Program resources, and medical leave benefits, subject to applicable eligibility requirements. Certain positions may also be eligible for bonus, commission, or other incentive compensation.