Security Engineer - GRC Frameworks & AI Governance

SpaceXSI is seeking a mid-level Security Engineer focused on GRC frameworks and AI governance to join its security and AI governance team in Palo Alto, CA. This role helps design and implement compliance controls, automate evidence and assurance, and keep AI systems audit-ready across enterprise, commercial, and public-sector environments.

Responsibilities

• Execute security compliance implementation and audits across SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act, including control design, mapping, gap assessments, evidence collection, and remediation tracking.
• Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, continuous evidence pipelines, and monitoring integrated into development and deployment workflows.
• Operate and extend GRC platforms (for example, Vanta) as the system of record for controls, evidence, and audit readiness, integrating with cloud, identity, and engineering tooling to reduce manual effort.
• Partner with engineering and architecture to embed compliance requirements early in design reviews, translating framework obligations into technical control narratives that support auditor expectations.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures that support the company’s governance and AI management system posture.
• Identify, assess, and prioritize risks across AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments, focusing on meaningful business risk versus compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with attention to AI system risks such as data handling, model governance, and agentic and conversational surfaces.
• Own and cultivate relationships with external auditors, assessors (including QSAs where applicable), and regulators, acting as a bridge between auditors and internal teams.
• Champion a companywide culture of security and compliance by educating teams on why controls exist, not only enforcing them.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 3+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert-level working knowledge of SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001, including building and running controls.
• Experience with Compliance-as-Code and GRC automation tooling (such as Vanta or Drata) with a bias toward continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and collaborate with engineers on remediation.

Technologies

• SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, EU AI Act
• Compliance-as-Code, policy-as-code, Vanta, Drata
• AWS, GCP, Azure
• GRC platforms, CI/CD, cloud

Preferred Skills and Experience

• 5+ years of security compliance, GRC engineering, or technology audit-related experience.
• Hands-on experience implementing technical controls such as IAM, logging and monitoring, encryption, and infrastructure hardening, including integration of compliance checks into CI/CD pipelines.
• Experience in the tech or AI/ML industry, especially startups or high-growth product organizations.
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, particularly in a publicly traded or IPO-bound company.
• Strong understanding of AI ethics and AI governance frameworks (including NIST AI RMF, ISO 42001, and the EU AI Act) and associated operational risks.
• Working knowledge of data privacy frameworks such as GDPR and CCPA in a technology or cloud environment.
• Exceptional analytical, problem-solving, organizational, and project management skills to take compliance programs from conception to audit-ready launch.
• Excellent communication and stakeholder management, with the ability to explain risk and tradeoffs to engineering, legal, sales, and executives in plain language.
• Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar preferred.
• Public sector or federal compliance experience (such as FedRAMP, NIST 800-171, or CMMC) is a plus.

Compensation

$100,000 - $198,000 USD

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

Location: Palo Alto, CA (onsite)

Minimum Experience: 3 years