Security Engineer - Governance Risk Compliance

SpaceXAI; Iowa; On-site; USD 100,000 - 258,000; Full time

Benefits offered by this job

Equity

Medical, vision, dental

401(k) retirement plan

Short & long-term disability

Life insurance

Employee discounts

Job summary

SpaceXAI is seeking a Governance, Risk, and Compliance professional to drive regulatory adherence and risk management across AI initiatives. You will coordinate with federal bodies and 3PAOs to obtain certifications, support ATOs, and implement RMF-aligned controls.

Responsibilities include risk assessment, incident response planning, and ensuring cloud security and DoD/FedRAMP compliance. Strong communication and collaboration with cross‑functional teams are essential.

Qualifications

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 3+ years of experience in governance, risk management, compliance, or technology audit roles.
• Experience with vulnerability management, POAMs, STIG implementation, and cloud security controls.

Responsibilities

• Execute security compliance implementation and audits (ISO 27001/42001, SOC2, FedRAMP HIGH, DoD SRG IL5/IL6, NIST 800-53 rev 5, 800-171/CMMC).
• Collaborate with 3PAOs, AOs, and government to achieve certifications and ATO status.
• Identify, assess, and prioritize risks related to AI operations, cybersecurity, and cloud deployments.
• Design and implement risk mitigation strategies including POAMs, STIGs, and monitoring systems.
• Oversee security configurations and procedures throughout project lifecycles.
• Serve as liaison between system owners, security personnel, and cross-functional teams.
• Lead A&A processes, cloud risk assessments, and compliance reviews for new products.
• Conduct regular risk assessments, threat analyses, and RMF-related reviews.
• Oversee audits, third-party assessments, and vulnerability management to ensure compliance.
• Provide guidance on risk, compliance, and cybersecurity to leadership; translate risks clearly.
• Create and present regular GRC performance and compliance reports to executives.

Skills

Governance & Risk

Compliance

Vulnerability management

POAMs

STIG implementation

Cloud security controls

Communication skills

Education

Bachelor's degree in computer science, Information Security, Cybersecurity, or engineering/STEM

Tools

ACAS

RMF tooling

ISO/NIST compliance tooling

Job description

Security Engineer - Governance Risk Compliance

New York, NY; Palo Alto, CA; Washington, D.C.

SpaceXAI’s mission is to create AI systems that can accurately understand the universe and aid humanity in its pursuit of knowledge. Our team is small, highly motivated, and focused on engineering excellence. This organization is for individuals who appreciate challenging themselves and thrive on curiosity. We operate with a flat organizational structure. All employees are expected to be hands‑on and to contribute directly to the company’s mission. Leadership is given to those who show initiative and consistently deliver excellence. Work ethic and strong prioritization skills are important. All employees are expected to have strong communication skills and be able to concisely and accurately share knowledge with their teammates.

ABOUT THE ROLE:

We are seeking an experienced and strategic Governance, Risk, and Compliance (GRC) team member as we expand into government and public sector applications of AI. This critical role will ensure that SpaceXAI operates within regulatory, ethical, operational, and federal boundaries while fostering a culture of integrity and resilience. You will collaborate with cross‑functional teams to safeguard our mission‑driven work in AI development and deployment, including support for sensitive and classified environments.

RESPONSIBILITIES:

• Execute security compliance implementation and audits (e.g., ISO 27001/42001, SOC2, FedRAMP HIGH, DoD Cloud Computing SRG IL5/IL6, NIST 800-53 rev 5, NIST 800-171/CMMC, Risk Management Framework).
• Work with 3PAOs (Third‑Party Assessment Organizations) and federal government Authorizing Officials (AOs) to achieve compliance certifications, reports, and Authorized to Operate (ATO) status.
• Identify, assess, and prioritize risks related to AI operations, cybersecurity, regulatory compliance, intellectual property, and cloud deployments.
• Design and implement risk mitigation strategies, including monitoring systems, contingency plans, vulnerability scans, Plan of Action and Milestones (POAMs), and STIGs.
• Ensure the implementation, oversight, monitoring, and maintenance of security configurations, practices, and procedures throughout the project lifecycle.
• Serve as a liaison between system owners, security personnel, and cross‑functional teams to facilitate effective communication, collaboration, and control implementation.
• Lead Risk Management Assessment and Authorization (A&A) processes, cloud system risk assessments, compliance reviews for new products/changes/features, and process enhancements.
• Conduct regular risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
• Oversee audits, certifications, third‑party assessments, and vulnerability management to maintain compliance and operational credibility.
• Act as a subject matter expert, providing guidance on risk, compliance, and cybersecurity matters; translate business and technical risks for leadership.
• Create and present regular reports on GRC performance, risks, and compliance status to senior leadership and stakeholders.

BASIC QUALIFICATIONS:

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 3+ years of experience in governance, risk management, compliance, or technology audit roles.
• Experience with vulnerability management, POAMs, STIG implementation, and cloud security controls.

PREFERRED SKILLS AND EXPERIENCE:

• 5+ years of security compliance or technology audit‑related experience.
• Previous systems engineering experience strongly preferred.
• Ability to evaluate control objectives with IT configurations.
• Experience in the tech or AI industry, particularly with startups, innovative organizations, or government/public sector engagements.
• Proven expertise in regulatory frameworks, data privacy, cybersecurity, and federal compliance standards, preferably in a technology, cloud, or AI‑driven environment.
• Strong understanding of AI ethics, emerging technologies, Risk Management Framework (RMF), and associated risks.
• Exceptional analytical, problem‑solving, organizational, and project management skills, with the ability to balance innovation, oversight, and taking projects from conception to launch.
• Excellent communication, stakeholder management, and translation skills, with experience influencing cross‑functional teams and communicating risks to leadership.
• Ability to thrive in a fast‑paced, dynamic environment and adapt to evolving priorities.
• Certifications like CISA, CRISC, CGEIT, Security+, CASP+, or similar preferred.
• Deep expertise maintaining frameworks such as FedRAMP, DoD Cloud Computing SRG, NIST 800-171, NIST 800-53, CMMC, and STIG/RMF policies (including validation via ACAS and similar tools).
• Familiarity with ISO 27001, ISO 42001, NIST, SOC 2, or similar compliance frameworks.
• Background in managing third‑party risk, vendor compliance programs, or federal assessments.
• Understanding of cybersecurity controls for cloud service providers.
• Knowledge of government cloud services and evolving certification programs.

COMPENSATION AND BENEFITS:

$100,000 - $258,000 USD

Base salary is just one part of our total rewards package at SpaceXAI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long‑term disability insurance, life insurance, and various other discounts and perks.

• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.