Security Engineer - GRC Federal Frameworks

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) professional to help scale its security compliance program. This onsite role in Washington, DC focuses on NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 authorization processes, with an emphasis on continuous monitoring artifacts and close partnership with engineering teams to implement and validate controls.

Responsibilities

• Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D. (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and Risk Management Framework activities.
• Oversee audits, certifications, third-party assessments, and vulnerability management to support sustained compliance and operational credibility.
• Design and implement risk mitigation strategies, including monitoring systems, contingency planning, vulnerability scans, Plan of Action and Milestones (POAMs), and STIGs.
• Ensure security configurations, practices, and procedures are implemented, monitored, and maintained across the project lifecycle.
• Act as a liaison between system owners, security personnel, and cross-functional teams to support communication, collaboration, and control implementation.
• Lead Risk Management Assessment and Authorization (A& A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process improvements.
• Perform regular risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
• Serve as a subject matter expert on risk, compliance, and cybersecurity matters; translate business and technical risk for leadership.
• Create and present recurring reports on GRC performance, risks, and compliance status for senior leadership and stakeholders.

Required Qualifications

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 3+ years of experience in governance, risk management, compliance, or technology audit roles.
• At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
• Experience implementing and maintaining security compliance frameworks and cloud security controls.
• Expert-level knowledge in at least one domain: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D., and/or NIST 800-171/CMMC.

Relevant Technologies

• NIST Risk Management Framework (RMF)
• FedRAMP
• Impact Level 4/5 (IL4/IL5)
• DoD Cloud Computing SRG IL5/IL6
• FedRAMP Class D. (Rev. 5 / CR2026)
• NIST 800-53
• NIST 800-171/CMMC
• Plan of Action and Milestones (POAMs)
• STIGs
• Risk Management Assessment and Authorization (A& A)
• Continuous Monitoring

Preferred Skills and Experience

• 5+ years of security compliance or technology audit-related experience.
• Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
• Strong analytical, problem-solving, organizational, and project management capabilities, including balancing innovation, oversight, and delivery from concept to launch.
• Ability to evaluate control objectives with IT configurations.
• Hands-on experience implementing technical controls, not solely assessing them.
• Experience in the tech or AI industry, especially with startups or innovative organizations.
• Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code (e.g., policy-as-code frameworks like OPA), automated control validation, and continuous compliance monitoring integrated into the deployment pipeline.
• Excellent communication and stakeholder management skills, including translating risks to leadership and influencing cross-functional teams.
• Experience with commercial compliance programs (e.g., ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar) is a plus.

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short and long-term disability insurance
• Life insurance
• Various other discounts and perks

Compensation and Location

• Location: Washington, DC (onsite)
• Salary: USD 100,000 to 198,000 per year

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.