Security GRC Engineer: Compliance & Risk

Airlife; El Paso (TX); On-site; USD 115,000 - 130,000; Full time

Job summary

AirLife is seeking a Security Engineer-Governance, Risk & Compliance to mature the company’s information security risk management and compliance posture in a medical device manufacturing environment. You will align IT controls with FDA/ISO requirements, manage audit evidence, and collaborate with external providers.

The role requires 4–6 years IT with 3+ years in cybersecurity focusing on GRC, audits, and regulatory compliance.

Qualifications

• Experience with security risk frameworks: NIST CSF, NIST SP 800-30/37, ISO 27001, CIS Controls.
• Regulatory requirements for medical devices: FDA 21 CFR Part 820/QMSR and ISO 13485 in IT
• Experience supporting ITGC audits and PE-backed manufacturing controls.
• Knowledge of GDPR and US state privacy laws and IT implications.
• Experience conducting risk assessments, gap analyses, and remediation tracking.
• Experience developing and maintaining security policies, standards, and evidence libraries.
• Familiarity with vulnerability management programs and phishing simulation training (KnowBe4 preferred).
• Ability to work with MDR/MSSP providers (Arctic Wolf a plus).
• GRC/cybersecurity certifications preferred (CISA, CRISC, CompTIA Security+, SSCP).

Responsibilities

• Develop, implement, and maintain AirLife's information security policies, standards, and procedures.
• Conduct periodic security risk assessments and gap analyses across IT and OT, documenting findings and remediation.
• Own AirLife's security compliance posture across applicable frameworks (NIST CSF, CIS, ISO 27001, GDPR).
• Support ITGC compliance: access reviews, change management, audit evidence packages.
• Coordinate with QA/RA/Legal to align controls with 21 CFR Part 820/QMSR and ISO 13485.
• Own and administer security awareness training including KnowBe4 campaigns.
• Maintain and improve vulnerability management, tracking remediation and trends.
• Collaborate with managed security providers to ensure alignment with compliance posture.
• Maintain IT incident response playbook and assist with tabletop exercises.
• Prepare evidence packages for audits and manage remediation tracking to closure.
• Build a comprehensive GRC documentation library (risk register, policy library, calendar, audit history).
• Support cyber insurance preparation and security metrics requests.

Skills

Security risk management

Regulatory compliance

IT General Controls

Data privacy regulations

Audit support & remediation

Policy & control documentation

Vulnerability management

Security awareness training

MDR/MSSP coordination

Written communication

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

KnowBe4

Smartsheet

Arctic Wolf

Job description

AirLife is seeking a Security Engineer-Governance, Risk & Compliance to mature the company’s information security risk management and compliance posture in a medical device manufacturing environment. You will align IT controls with FDA/ISO requirements, manage audit evidence, and collaborate with external providers.

The role requires 4–6 years IT with 3+ years in cybersecurity focusing on GRC, audits, and regulatory compliance.