Security Engineer-Governance, Risk & Compliance

AirLife

Grand Rapids (MI)

On-site

USD 90,000 - 140,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

medical coverage

dental coverage

vision coverage

401(k)

paid time off

paid holidays

bereavement leave

Employee Assistance Program resources

medical leave benefits

bonus

commission

other incentive compensation

Job summary

AirLife is seeking a Security Engineer – Governance, Risk & Compliance to mature the company’s information security posture in a medical device manufacturing environment. You will lead risk assessments, develop policies, and coordinate with QA/RA and Legal on regulatory obligations including FDA and ISO standards.

You will manage vulnerability programs, security training (KnowBe4), and coordinate with MDR/MSSP providers, aiming to align with external auditors and insurers.

Qualifications

Strong knowledge of risk management frameworks: NIST CSF, NIST 800-30/37, ISO 27001, CIS Controls.
Understanding regulatory compliance for medical device manufacturing (FDA 21 CFR Part 820 / QMSR, ISO 13485) and ITGC.
Experience with IT General Controls and SOX-adjacent controls in PE-backed manufacturing.
Knowledge of data privacy regulations (GDPR, US state laws) and IT implications.
Experience conducting risk assessments and gap analyses; document findings and remediation.
Developing and maintaining security policies, standards, procedures, and evidence libraries.
Familiarity with vulnerability management programs and remediation tracking.
Experience administering security awareness training (KnowBe4 preferred).
Ability to work with MDR/MSSP providers to align with compliance posture (Arctic Wolf a plus).
Strong written communication; document findings and present risk to executives/auditors.
Proficiency with project and task management tools; Smartsheet preferred.
Industry-recognized GRC or cybersecurity certifications preferred (CISA, CRISC, CompTIA Security+, SSCP).

Responsibilities

Develop, implement, and maintain information security policies and procedures.
Conduct security risk assessments and gap analyses across IT and operational technology.
Own AirLife's security compliance posture across NIST CSF, CIS Controls, ISO 27001, GDPR.
Support ITGC compliance: access reviews, change management, audit evidence.
Coordinate IT security controls with QA/RA and Legal & Compliance for 21 CFR Part 820/QMSR and ISO 13485.
Administer security awareness training; plan KnowBe4 campaigns and track completion.
Maintain vulnerability management program; track remediation and trends.
Support benchmarking with Frazier Partners and insurance assessment prep.
Collaborate with Arctic Wolf and MSSPs to align services with compliance posture.
Maintain Incident Response Playbook; assist in tabletop exercises.
SME for audits; prepare evidence and manage remediation.
Build and maintain GRC docs: risk register, control matrix, policy library.

Skills

Security risk mgmt

Regulatory compliance

ITGC

Data privacy

Risk assessments

Policies & procedures

Vulnerability management

Security awareness

MDR/MSSP coordination

Technical writing

Project management

Security certifications

Education

Bachelor's degree in Cybersecurity/IT/CS or related

Tools

KnowBe4

Smartsheet

Arctic Wolf

Job description

Company Description

At AirLife, we are dedicated to improving the quality of every breath. Excellence with Every Breath is not just a tag line, but the way we work and take care of our customers. With a mindset to evolve, innovate, and grow, we are a premier manufacturer of the highest-quality and market-leading breathing consumables. This growth philosophy has positioned us to increase our global footprint and business reach, impacting even more people around the world. Our expanding family of the most trusted brands offers a product portfolio that spans the continuum of care from first responder to home care, with safety, patient comfort, and clinical performance in mind. Collective expertise allows us to provide quality products and experiences to our patients, customers, and our people. Our values of Customer first, Differentiate with our People, Bias for Action, Continuous Improvement and Accountability define who we are and how we work. Join us!

Position Summary

The Security Engineer – Governance, Risk & Compliance is responsible for establishing and maturing AirLife's information security risk management and compliance posture. This role evaluates, quantifies, and helps mitigate security risks across IT infrastructure and business systems, while ensuring AirLife's cybersecurity practices remain aligned to applicable regulatory frameworks, industry standards, and internal policies. Operating in a medical device manufacturing environment with FDA and ISO regulatory obligations and a PE ownership structure with specific cybersecurity reporting requirements, this role brings both technical security knowledge and a compliance mindset to a rapidly maturing IT security program. The Security Engineer – GRC plays a critical role in AirLife's ability to satisfy external auditors, insurance underwriters, and PE sponsor security benchmarking requirements.

Position Qualifications

Knowledge, Skills & Abilities:

Strong working knowledge of security risk management frameworks and methodologies, including NIST CSF, NIST SP 800-30/37, ISO 27001, and CIS Controls.
Understanding of regulatory compliance requirements relevant to medical device manufacturing, including FDA 21 CFR Part 820 / QMSR and ISO 13485, and their implications for IT General Controls (ITGC) and computer system validation.
Experience with IT General Controls frameworks and audit support, including SOX-adjacent controls applicable to PE-backed manufacturing companies.
Knowledge of data privacy regulations, including GDPR and applicable US state privacy laws, and their operational IT implications.
Experience conducting risk assessments, gap analyses, and security control reviews; ability to document, prioritize, and track findings through to remediation.
Experience developing and maintaining security policies, standards, procedures, and control evidence libraries.
Familiarity with vulnerability management programs, including scanning tooling, remediation tracking, and risk-based prioritization.
Experience administering security awareness training programs, including phishing simulation and completion tracking (KnowBe4 experience preferred).
Ability to work with MDR/MSSP providers to ensure managed detection capabilities align with AirLife's compliance posture (Arctic Wolf experience a plus).
Strong written communication skills; ability to clearly document findings, prepare audit evidence packages, and present risk posture to non-technical audiences including executives and external auditors.
Proficiency with project and task management tools; Smartsheet experience preferred.
Industry-recognized GRC or cybersecurity certification(s) preferred (CISA, CRISC, CompTIA Security+, SSCP, or equivalent).

Level Of Experience

Minimum 4–6 years of IT experience with 3+ years in a cybersecurity role with a GRC, compliance, or risk management focus. Experience in a regulated manufacturing, medical device, or life sciences environment strongly preferred.

Level Of Education

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent experience. GRC-relevant certification(s) preferred.

Travel

Up to 20% as required by the business.

Essential Duties And Responsibilities

Develop, implement, and maintain AirLife's information security policies, standards, and procedures, ensuring they remain current, compliant with applicable frameworks, and operationally effective for the teams they govern.
Conduct and facilitate periodic security risk assessments and gap analyses across IT infrastructure, business applications, and operational technology, documenting findings, quantifying risk, and recommending prioritized remediation measures to IT leadership.
Own AirLife's security compliance posture across applicable frameworks (NIST CSF, CIS Controls, ISO 27001, GDPR), including control documentation, evidence collection, ongoing compliance monitoring, and management of compliance calendars.
Support IT General Controls (ITGC) compliance, including access control review coordination, change management process documentation, and preparation and management of audit evidence packages for internal and external auditors.
Partner with QA/RA and Legal & Compliance to ensure IT security controls are appropriately aligned to AirLife's 21 CFR Part 820 / QMSR and ISO 13485 obligations, particularly as they relate to computer system validation and access control in regulated processes.
Own and administer AirLife's security awareness and compliance training program, including planning and coordinating KnowBe4 phishing simulation and training campaigns, tracking completion rates across departments, and reporting to IT leadership on compliance status.
Maintain and improve AirLife's vulnerability management program, including scheduling assessments, tracking and prioritizing remediation, and reporting vulnerability posture and trends to IT leadership.
Support Frazier Partners' cybersecurity benchmarking and reporting requirements; coordinate with Lockton for cyber insurance assessment preparation and supply requested security metrics, documentation, and evidence as required.
Collaborate with Arctic Wolf and other managed security service providers to ensure managed services are operating in alignment with AirLife's compliance posture, risk appetite, and applicable regulatory requirements.
Maintain, test, and continuously improve the IT Cyber Incident Response Playbook; support the planning and facilitation of tabletop exercises; assist in incident response coordination and post-incident review when security events occur.
Serve as the IT security subject matter expert for IT-related internal and external audits: prepare evidence packages, coordinate audit interviews, manage finding responses, and own remediation tracking through closure (including all enterprise applications and segregation-of-duties findings).
Build and maintain a comprehensive GRC documentation library, including the risk register, control matrix, policy library, compliance calendar, and audit history, ensuring currency and accessibility for authorized stakeholders.

Other Responsibilities

Uphold and embody AirLife's values in all aspects of work.
Demonstrate accuracy and thoroughness in daily work; look for ways to improve and promote quality & safety.
Inspire the trust of others; treat people with respect and dignity and embrace the value of diversity.
Use time efficiently; perform job accurately, thoroughly, and conserve Company resources to improve profits.
Contribute to building and maintaining a positive team environment.
Assure all policies and guidelines are implemented and followed.

QUALITY POLICY

At AirLife, Quality is our promise. It is our commitment to customer satisfaction and our dedication to product excellence in an evolving global healthcare market. This promise is kept through a continuously improving and effective Quality Management System and compliance to Regulatory Requirements.

DEIA STATEMENT

At AirLife, we are committed to building a diverse workforce and an inclusive workplace that reflects the communities and customers we serve. We believe our philosophy on Diversity, Equity, Inclusion, and Advancement (DEIA) encourages excellence and equips us to serve an evolving global marketplace.

Please note: The responsibilities outlined above are not exhaustive and may evolve over time. The role holder may be required to undertake additional duties as reasonably expected to meet the needs of the company.

Benefits