Security Engineer - GRC Federal Frameworks

Details

We are seeking an experienced and strategic Governance, Risk, and Compliance (GRC) team member to help scale the GRC program as SpaceXSI grows. This role will help ensure that SpaceXSI operates within regulatory, ethical, and operational boundaries while fostering a culture of integrity and resilience.

The primary focus is providing and sustaining deep expertise in the NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 (IL4/IL5) authorization processes. The role applies these frameworks throughout the full authorization and certification lifecycle, including technical implementation. The position also manages Continuous Monitoring artifacts and annual assessments for Grok for Government and partners directly with engineers to design, implement, and validate controls.

Responsibilities

• Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and the Risk Management Framework.
• Oversee audits, certifications, third-party assessments, and vulnerability management.
• Design and implement risk mitigation strategies, including monitoring systems, contingency plans, vulnerability scans, Plans of Action and Milestones (POA&Ms), and STIGs.
• Ensure the implementation, oversight, monitoring, and maintenance of security configurations, practices, and procedures throughout the project lifecycle.
• Serve as a liaison between system owners, security personnel, and cross-functional teams to facilitate communication, collaboration, and control implementation.
• Lead Risk Management Assessment and Authorization (A&A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process enhancements.
• Conduct regular risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
• Act as a subject matter expert on risk, compliance, and cybersecurity matters and translate business and technical risks for leadership.
• Create and present regular reports on GRC performance, risks, and compliance status to senior leadership and stakeholders.

Requirements

• Bachelor's degree in computer science, information security, cybersecurity, or an engineering/STEM field.
• 3+ years of experience in governance, risk management, compliance, or technology audit roles.
• At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
• Experience implementing and maintaining security compliance frameworks and cloud security controls.
• Expert-level knowledge in at least one of the following domains: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D, or NIST 800-171/CMMC.
• 5+ years of security compliance or technology audit-related experience is preferred.
• Hands-on experience implementing technical controls such as IAM, logging and monitoring, encryption, and infrastructure hardening, rather than only assessing them.
• Experience integrating compliance checks into CI/CD pipelines.
• Experience with the tech or AI industry, particularly startups or innovative organizations, is preferred.
• Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code, policy-as-code frameworks such as OPA, automated control validation, and continuous compliance monitoring integrated into deployment pipelines.
• Strong analytical, problem-solving, organizational, project management, communication, stakeholder management, and translation skills.
• Ability to evaluate control objectives against IT configurations and communicate risks to leadership.
• Experience with commercial compliance programs such as ISO 27001, ISO 42001, SOC 2, NIST CSF, or NIST 800-53 is a plus.
• To conform to U.S. Government export regulations, applicants must be a U.S. citizen or national, U.S. lawful permanent resident, refugee under 8 U.S.C. § 1157, asylee under 8 U.S.C. § 1158, or eligible to obtain the required authorizations from the U.S. Department of State.

Benefits

Base salary is one part of the total rewards package, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short- and long-term disability insurance, life insurance, discounts, and other perks.