Security Engineer - GRC Frameworks & AI Governance

SECURITY ENGINEER, GRC FRAMEWORKS & AI GOVERNANCE

RESPONSIBILITIES:

• Execute security compliance implementation and audits across core frameworks including SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act, including control design, mapping, gap assessment, evidence collection, and remediation tracking
• Build and maintain Compliance-as-Code and continuous compliance capabilities — policy-as-code, automated control validation, continuous evidence pipelines, and monitoring integrated into development and deployment workflows — so the company can move fast without cutting corners
• Operate and extend GRC platforms (e.g., Vanta) as the system of record for controls, evidence, and audit readiness; integrate them with cloud, identity, and engineering tooling to reduce manual toil
• Partner with engineering and architecture to embed compliance requirements early in design reviews; translate framework obligations into clear technical control narratives that satisfy auditors without slowing delivery
• Develop, maintain, and continuously improve corporate policies, standards, and procedures that support the company's governance and AI management system posture
• Identify, assess, and prioritize risks related to AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments; distinguish meaningful business risk from compliance theater
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with particular attention to AI system risks (data handling, model governance, agentic and conversational surfaces)
• Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; serve as the bridge between auditors and internal teams so requests are reasonable, clear, and relevant to our stack
• Champion a culture of security and compliance across the company — educating teams on why controls exist, not only enforcing them

BASIC QUALIFICATIONS:

• Bachelor's degree in computer science, information security, cybersecurity, or an engineering/STEM field
• 3+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities
• Experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure)

PREFERRED SKILLS AND EXPERIENCE:

• Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, Drata, or similar), with a bias toward continuous monitoring
• Expert-level working knowledge of several of the following: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001 — including building and running controls, not only reading the frameworks
• Ability to evaluate control objectives against real IT and cloud configurations and to work alongside engineers on remediation
• 5+ years of security compliance, GRC engineering, or technology audit-related experience
• Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines
• Experience in the tech or AI/ML industry, particularly with startups or high-growth product organizations
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, especially in a publicly traded or IPO-bound company
• Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act) and associated operational risks
• Working knowledge in data privacy frameworks (e.g., GDPR, CCPA) in a technology or cloud environment
• Exceptional analytical, problem-solving, organizational, and project management skills, with the ability to take compliance programs from conception to audit-ready launch
• Excellent communication and stakeholder management skills — able to explain risk and tradeoffs to engineers, legal, sales, and executives in plain language
• Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar preferred
• Experience with public sector or federal compliance programs (e.g., FedRAMP, NIST 800-171, CMMC) is a plus

ADDITIONAL REQUIREMENTS:

• This role may also include additional tasks and responsibilities as needed to support the team and evolving business priorities

COMPENSATION AND BENEFITS:

$100,000 - $198,000 USD

Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.

ITAR REQUIREMENTS:

• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.