Compliance As Code Cybersecurity Jobs

1 job found

Today

Sr. Security Engineer - GRC Frameworks & AI Governance

SpaceXSI Washington, DC

Washington, DC

Today

$152k - $258k/yr Full time Ai Security Cloud Platforms Compliance As Code

Apply Now

Job Description

SpaceXSI is seeking an experienced GRC Engineer to design, automate, and continuously validate security and AI governance controls across multiple regulatory environments.

Responsibilities

Own security compliance implementation and audits across core frameworks: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act; cover control design, mapping, gap assessments, evidence collection, and remediation tracking.
Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, continuous evidence pipelines, and monitoring embedded into development and deployment workflows.
Operate and extend GRC platforms (example: Vanta) as the system of record for controls, evidence, and audit readiness; integrate with cloud, identity, and engineering tooling to reduce manual effort.
Partner with engineering and architecture to embed compliance expectations early in design reviews; translate framework requirements into technical control narratives that support auditor needs without slowing delivery.
Develop, maintain, and continuously improve corporate policies, standards, and procedures supporting governance and the company’s AI management system posture.
Identify, assess, and prioritize risks across AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments; distinguish material business risk from compliance theater.
Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with focus on AI system risks (data handling, model governance, agentic and conversational surfaces).
Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; act as the bridge between auditors and internal teams to keep requests reasonable, clear, and aligned with the company’s stack.
Champion a company-wide security and compliance culture by educating teams on the purpose of controls in addition to enforcing requirements.

Requirements

Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
Expert working knowledge of several of: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001, including building and running controls.
Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, Drata, or similar), with a bias toward continuous monitoring.
Ability to evaluate control objectives against real IT and cloud configurations and to collaborate with engineers on remediation.

Technologies

SOC 2, NIST CSF, NIST SP 800-53
ISO 27001, ISO 42001
EU AI Act
Compliance-as-Code, policy-as-code
GRC platforms, Vanta, Drata
AWS, GCP, Azure
CI/CD, IAM
Logging and monitoring, encryption, infrastructure hardening
NIST AI RMF, GDPR, CCPA, HIPAA, SOX / ITGC
FedRAMP, NIST 800-171, CMMC

Preferred Skills and Experience

10+ years of security compliance, GRC engineering, or technology audit-related experience.
Hands-on implementation of technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integration of compliance checks into CI/CD pipelines.
Experience in tech or AI/ML, especially startups or high-growth product organizations.
Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, particularly in a publicly traded or IPO-bound company.
Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act) and associated operational risks.
Working knowledge of data privacy frameworks (e.g., GDPR, CCPA) in a technology or cloud environment.
Strong analytical, problem-solving, organizational, and project management skills to take compliance programs from conception to audit-ready launch.
Excellent communication and stakeholder management skills for explaining risk and tradeoffs to engineers, legal, sales, and executives.
Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar.
Experience with public sector or federal compliance programs (e.g., FedRAMP, NIST 800-171, CMMC) is a plus.

Benefits

Equity
Comprehensive medical, vision, and dental coverage
401(k) retirement plan
Short & long-term disability insurance
Life insurance
Various other discounts and perks

Compensation

$152,000 - $258,000 USD
Base salary is part of a total rewards package including equity, medical, vision, dental, 401(k), short & long-term disability, life insurance, and other discounts and perks.

ITAR Requirements

Applicant must be a U.S. citizen or national, U.S. lawful permanent resident (green card holder), Refugee under 8 U.S.C. § 1157, or Asylee under 8 U.S.C. § 1158, or be eligible to obtain required authorizations from the U.S. Department of State.

View full job page →

Get Compliance As Code Cybersecurity Jobs alerts

New Compliance As Code Cybersecurity Jobs, daily.