Security Engineer, GRC & Compliance — Risk & Audit Ready

AirLife group; Grand Rapids (MI); Hybrid; USD 115,000 - 130,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

401(k)

Paid time off

Job summary

AirLife is seeking a Security Engineer – Governance, Risk & Compliance to advance our information security program in a regulated medical device manufacturing environment. You will lead risk assessments, ensure regulatory alignment (FDA 21 CFR Part 820, ISO 13485, GDPR), and manage audit readiness across IT and operational technology.

The role requires 4–6 years IT, 3+ years cybersecurity with a GRC focus, plus strong policy development and coordination with QA/RA, Legal, and external auditors.

Qualifications

• Knowledge of security risk management frameworks and regulatory regimes.
• Experience with ITGC and audit support in regulated environments.
• Familiarity with GDPR and US state privacy laws and IT implications.
• Ability to document findings and remediation plans for leadership.
• Proven ability to create and maintain security policies and control evidence.

Responsibilities

• Develop and maintain AirLife's security policies, standards, and procedures.
• Conduct periodic risk assessments and gap analyses and prioritize remediation.
• Own AirLife's security compliance posture across frameworks (NIST, ISO, GDPR).
• Support ITGC compliance and prepare audit evidence for auditors.
• Coordinate with QA/RA and Legal to align controls with FDA/ISO obligations.
• Administer security awareness training and phishing simulations.
• Maintain vulnerability management program and report trends to leadership.
• Collaborate with MDR/MSSP providers to ensure aligned security services.
• Prepare evidence packages and manage remediation tracking for audits.

Skills

NIST CSF

NIST SP 800-30/37

ISO 27001

CIS Controls

FDA 21 CFR Part 820 / QMSR

ISO 13485

ITGC controls

SOX controls

GDPR knowledge

risk assessments

security policies

vulnerability management

KnowBe4

MDR/MSSP coordination

Arctic Wolf

audit coordination

communication with executives

Education

Bachelor's degree in Cybersecurity/IT/CS

GRC-relevant certification(s)

Tools

Smartsheet

Job description

AirLife is seeking a Security Engineer – Governance, Risk & Compliance to advance our information security program in a regulated medical device manufacturing environment. You will lead risk assessments, ensure regulatory alignment (FDA 21 CFR Part 820, ISO 13485, GDPR), and manage audit readiness across IT and operational technology.

The role requires 4–6 years IT, 3+ years cybersecurity with a GRC focus, plus strong policy development and coordination with QA/RA, Legal, and external auditors.