SpaceXSI is seeking an experienced Security Engineer to scale its Governance, Risk, and Compliance (GRC) program across federal frameworks.

Execute security compliance implementations and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D. (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and Risk Management Frameworks.
Oversee audits, certifications, third-party assessments, and vulnerability management to sustain compliance and operational credibility.
Design and implement risk mitigation strategies covering monitoring systems, contingency plans, vulnerability scanning, POAMs, and STIGs.
Manage security configuration and control practices across the project lifecycle, including implementation, oversight, monitoring, and maintenance.
Act as a liaison among system owners, security personnel, and cross-functional teams to support effective communication, collaboration, and control implementation.
Lead Risk Management Assessment and Authorization (A&A) processes, cloud system risk assessments, compliance reviews for new products/changes/features, and process improvements.
Perform regular risk assessments and scenario analyses, including proactive evaluation of emerging threats, certifications, requirements, and technologies in the AI landscape.
Serve as a subject matter expert for risk, compliance, and cybersecurity, translating business and technical risks for leadership.
Create and present ongoing reports on GRC performance, risks, and compliance status for senior leadership and stakeholders.

Bachelor’s degree in computer science, Information Security, Cybersecurity, or engineering/STEM field.
3+ years of experience in governance, risk management, compliance, or technology audit roles.
At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
Experience implementing and maintaining security compliance frameworks and cloud security controls.
Expert-level knowledge in at least one of: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D., and/or NIST 800-171/CMMC.

5+ years of security compliance or technology audit-related experience.
Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
Analytical, problem-solving, organizational, and project management strengths, with the ability to balance innovation, oversight, and execution from conception to launch.
Ability to evaluate control objectives with IT configurations.
Experience in the tech or AI industry, particularly with startups or innovative organizations.
CI/CD and DevSecOps experience, including compliance-as-code (e.g., policy-as-code frameworks like OPA), automated control validation, and continuous compliance monitoring integrated into the deployment pipeline.
Strong communication and stakeholder management, including translating risks for leadership and influencing cross-functional teams.
Experience with commercial compliance programs (e.g., ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar) is a plus.

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

Location: Washington, DC (onsite) | Salary: USD 100,000 - 198,000 per yearly

Security Engineer - GRC Federal Frameworks

Job Description