Security Engineer - GRC Federal Frameworks

Cybersecurity Jobs; Washington (District of Columbia); Presencial; USD 100 000 - 198 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Equity

Medical, vision, and dental coverage

401(k) retirement plan

Short & long-term disability insurance

Life insurance

Other discounts and perks

Resumo da oferta

SpaceXSI in Washington, DC is seeking an experienced Security Engineer to scale its GRC program across federal frameworks. You will execute compliance implementations, oversee audits, and design risk mitigation strategies across monitoring, contingency plans, and STIGs.

Candidates should have 3+ years in governance, risk, compliance roles and hands-on experience with FedRAMP IL5/IL6, NIST, and DoD SRG frameworks. This role is on-site in Washington, DC with strong leadership exposure.

Qualificações

• Bachelor's degree in CS/InfoSec/Cybersecurity or STEM field.
• 3+ years in governance, risk management, compliance, or tech audit.
• At least 1 year with FedRAMP/IL5, vulnerability mgmt, and continuous monitoring.
• Experience implementing and maintaining security frameworks & cloud security controls.
• Expert knowledge in DoD SRG IL5/IL6, FedRAMP Class D, and/or NIST 800-171/CMMC.

Responsabilidades

• Execute security compliance implementations and audits across DoD SRG IL5/IL6, FedRAMP Class D.
• Oversee audits, third-party assessments, and vulnerability management.
• Design risk mitigation strategies for monitoring, contingency plans, POAMs, and STIGs.
• Manage security configuration across project lifecycle including oversight and maintenance.
• Coordinate among system owners, security personnel, and cross-functional teams.
• Lead A&A processes, cloud risk assessments, and compliance reviews for changes.
• Perform risk assessments and AI threat scenario analyses.
• Present GRC performance and risk reports to leadership.

Conhecimentos

Security compliance

Technology audit

CI/CD integration

DevSecOps

Policy as code

OPA

Stakeholder management

Cloud security controls

Threat risk assessment

Formação académica

Bachelor's degree in Computer Science / Information Security / Cybersecurity

Ferramentas

RMF

FedRAMP

IL4/IL5

DoD SRG IL5/IL6

FedRAMP Class D

NIST 800-53

NIST 800-171/CMMC

POAMs

STIGs

A&A

Continuous Monitoring

Descrição da oferta de emprego

SpaceXSI is seeking an experienced Security Engineer to scale its Governance, Risk, and Compliance (GRC) program across federal frameworks.

Responsibilities

• Execute security compliance implementations and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D. (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and Risk Management Frameworks.
• Oversee audits, certifications, third-party assessments, and vulnerability management to sustain compliance and operational credibility.
• Design and implement risk mitigation strategies covering monitoring systems, contingency plans, vulnerability scanning, POAMs, and STIGs.
• Manage security configuration and control practices across the project lifecycle, including implementation, oversight, monitoring, and maintenance.
• Act as a liaison among system owners, security personnel, and cross-functional teams to support effective communication, collaboration, and control implementation.
• Lead Risk Management Assessment and Authorization (A&A) processes, cloud system risk assessments, compliance reviews for new products/changes/features, and process improvements.
• Perform regular risk assessments and scenario analyses, including proactive evaluation of emerging threats, certifications, requirements, and technologies in the AI landscape.
• Serve as a subject matter expert for risk, compliance, and cybersecurity, translating business and technical risks for leadership.
• Create and present ongoing reports on GRC performance, risks, and compliance status for senior leadership and stakeholders.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or engineering/STEM field.
• 3+ years of experience in governance, risk management, compliance, or technology audit roles.
• At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
• Experience implementing and maintaining security compliance frameworks and cloud security controls.
• Expert-level knowledge in at least one of: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D., and/or NIST 800-171/CMMC.

Tools, Frameworks, and Technologies

• NIST Risk Management Framework (RMF)
• FedRAMP
• Impact Level 4/5 (IL4/IL5)
• DoD Cloud Computing SRG IL5/IL6
• FedRAMP Class D. (Rev. 5 / CR2026)
• NIST 800-53
• NIST 800-171/CMMC
• Plan of Action and Milestones (POAMs)
• STIGs
• Risk Management Assessment and Authorization (A&A)
• Continuous Monitoring

Preferred Skills and Experience

• 5+ years of security compliance or technology audit-related experience.
• Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
• Analytical, problem-solving, organizational, and project management strengths, with the ability to balance innovation, oversight, and execution from conception to launch.
• Ability to evaluate control objectives with IT configurations.
• Experience in the tech or AI industry, particularly with startups or innovative organizations.
• CI/CD and DevSecOps experience, including compliance-as-code (e.g., policy-as-code frameworks like OPA), automated control validation, and continuous compliance monitoring integrated into the deployment pipeline.
• Strong communication and stakeholder management, including translating risks for leadership and influencing cross-functional teams.
• Experience with commercial compliance programs (e.g., ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar) is a plus.

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

ITAR Requirements

• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

Location: Washington, DC (onsite) | Salary: USD 100,000 - 198,000 per yearly