Sr. Security Engineer - GRC Frameworks & AI Governance

Cybersecurity Jobs; Washington (District of Columbia); On-site; USD 152,000 - 258,000; Full time

Benefits offered by this job

Equity

Comprehensive medical, vision, and d d

401(k) retirement plan

Short & long-term disability insurance

Life insurance

Various other discounts and perks

Job summary

SpaceXSI is seeking an experienced GRC Engineer to design, automate, and validate security governance controls across regulatory environments.

The role focuses on implementing compliance across SOC 2, NIST CSF, ISO standards, and EU AI Act, with strong emphasis on Compliance-as-Code, CI/CD integration, and continuous monitoring to support auditable processes.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Experience implementing security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert working knowledge of SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, including building and running controls.
• Experience with Compliance-as-Code practices and tooling (Vanta, Drata, or similar), with a bias toward continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and collaborate with engineers on remediation.

Responsibilities

• Own security compliance implementation and audits across core frameworks (SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, EU AI Act).
• Build and maintain Compliance-as-Code and continuous compliance capabilities integrated into development workflows.
• Operate and extend GRC platforms (e.g., Vanta) as the system of record for controls, evidence, and audit readiness.
• Partner with engineering to embed compliance early in design reviews and translate requirements into technical narratives.
• Develop, maintain, and improve corporate policies, standards, and procedures supporting governance and AI management.

Skills

GRC engineering

Security compliance

Audits

Compliance-as-Code

CI/CD integration

Cloud security

Policy development

Education

Bachelor’s degree in Computer Science or Information Security

Tools

Vanta

Drata

GRC platforms

Job description

SpaceXSI is seeking an experienced GRC Engineer to design, automate, and continuously validate security and AI governance controls across multiple regulatory environments.

Responsibilities

• Own security compliance implementation and audits across core frameworks: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act; cover control design, mapping, gap assessments, evidence collection, and remediation tracking.
• Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, continuous evidence pipelines, and monitoring embedded into development and deployment workflows.
• Operate and extend GRC platforms (example: Vanta) as the system of record for controls, evidence, and audit readiness; integrate with cloud, identity, and engineering tooling to reduce manual effort.
• Partner with engineering and architecture to embed compliance expectations early in design reviews; translate framework requirements into technical control narratives that support auditor needs without slowing delivery.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures supporting governance and the company’s AI management system posture.
• Identify, assess, and prioritize risks across AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments; distinguish material business risk from compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with focus on AI system risks (data handling, model governance, agentic and conversational surfaces).
• Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; act as the bridge between auditors and internal teams to keep requests reasonable, clear, and aligned with the company’s stack.
• Champion a company-wide security and compliance culture by educating teams on the purpose of controls in addition to enforcing requirements.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert working knowledge of several of: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001, including building and running controls.
• Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, Drata, or similar), with a bias toward continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and to collaborate with engineers on remediation.

Technologies

• SOC 2, NIST CSF, NIST SP 800-53
• ISO 27001, ISO 42001
• EU AI Act
• Compliance-as-Code, policy-as-code
• GRC platforms, Vanta, Drata
• AWS, GCP, Azure
• CI/CD, IAM
• Logging and monitoring, encryption, infrastructure hardening
• NIST AI RMF, GDPR, CCPA, HIPAA, SOX / ITGC
• FedRAMP, NIST 800-171, CMMC

Preferred Skills and Experience

• 10+ years of security compliance, GRC engineering, or technology audit-related experience.
• Hands-on implementation of technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integration of compliance checks into CI/CD pipelines.
• Experience in tech or AI/ML, especially startups or high-growth product organizations.
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, particularly in a publicly traded or IPO-bound company.
• Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act) and associated operational risks.
• Working knowledge of data privacy frameworks (e.g., GDPR, CCPA) in a technology or cloud environment.
• Strong analytical, problem-solving, organizational, and project management skills to take compliance programs from conception to audit-ready launch.
• Excellent communication and stakeholder management skills for explaining risk and tradeoffs to engineers, legal, sales, and executives.
• Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar.
• Experience with public sector or federal compliance programs (e.g., FedRAMP, NIST 800-171, CMMC) is a plus.

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

Compensation

• $152,000 - $258,000 USD
• Base salary is part of a total rewards package including equity, medical, vision, dental, 401(k), short & long-term disability, life insurance, and other discounts and perks.

ITAR Requirements

• Applicant must be a U.S. citizen or national, U.S. lawful permanent resident (green card holder), Refugee under 8 U.S.C. § 1157, or Asylee under 8 U.S.C. § 1158, or be eligible to obtain required authorizations from the U.S. Department of State.