Sr. Security Engineer - GRC Frameworks & AI Governance

SpaceXSI is seeking an experienced GRC Engineer to design, automate, and continuously validate security and AI governance controls across multiple regulatory environments.

Responsibilities

• Own security compliance implementation and audits across core frameworks: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act; cover control design, mapping, gap assessments, evidence collection, and remediation tracking.
• Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, continuous evidence pipelines, and monitoring embedded into development and deployment workflows.
• Operate and extend GRC platforms (example: Vanta) as the system of record for controls, evidence, and audit readiness; integrate with cloud, identity, and engineering tooling to reduce manual effort.
• Partner with engineering and architecture to embed compliance expectations early in design reviews; translate framework requirements into technical control narratives that support auditor needs without slowing delivery.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures supporting governance and the company’s AI management system posture.
• Identify, assess, and prioritize risks across AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments; distinguish material business risk from compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with focus on AI system risks (data handling, model governance, agentic and conversational surfaces).
• Own and cultivate relationships with external auditors, assessors (e.g., QSAs where applicable), and regulators; act as the bridge between auditors and internal teams to keep requests reasonable, clear, and aligned with the company’s stack.
• Champion a company-wide security and compliance culture by educating teams on the purpose of controls in addition to enforcing requirements.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert working knowledge of several of: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001, including building and running controls.
• Experience with Compliance-as-Code practices and GRC automation tooling (e.g., Vanta, Drata, or similar), with a bias toward continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and to collaborate with engineers on remediation.

Technologies

• SOC 2, NIST CSF, NIST SP 800-53
• ISO 27001, ISO 42001
• EU AI Act
• Compliance-as-Code, policy-as-code
• GRC platforms, Vanta, Drata
• AWS, GCP, Azure
• CI/CD, IAM
• Logging and monitoring, encryption, infrastructure hardening
• NIST AI RMF, GDPR, CCPA, HIPAA, SOX / ITGC
• FedRAMP, NIST 800-171, CMMC

Preferred Skills and Experience

• 10+ years of security compliance, GRC engineering, or technology audit-related experience.
• Hands-on implementation of technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integration of compliance checks into CI/CD pipelines.
• Experience in tech or AI/ML, especially startups or high-growth product organizations.
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, particularly in a publicly traded or IPO-bound company.
• Strong understanding of AI ethics and AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act) and associated operational risks.
• Working knowledge of data privacy frameworks (e.g., GDPR, CCPA) in a technology or cloud environment.
• Strong analytical, problem-solving, organizational, and project management skills to take compliance programs from conception to audit-ready launch.
• Excellent communication and stakeholder management skills for explaining risk and tradeoffs to engineers, legal, sales, and executives.
• Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar.
• Experience with public sector or federal compliance programs (e.g., FedRAMP, NIST 800-171, CMMC) is a plus.

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

Compensation

• $152,000 - $258,000 USD
• Base salary is part of a total rewards package including equity, medical, vision, dental, 401(k), short & long-term disability, life insurance, and other discounts and perks.

ITAR Requirements

• Applicant must be a U.S. citizen or national, U.S. lawful permanent resident (green card holder), Refugee under 8 U.S.C. § 1157, or Asylee under 8 U.S.C. § 1158, or be eligible to obtain required authorizations from the U.S. Department of State.