Sr. Security Engineer - GRC Frameworks & AI Governance

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) Engineer to own and scale the organization’s security and AI governance compliance posture. In this onsite role in Washington, DC, you will design and automate compliance controls, establish continuous assurance, and help keep AI systems audit-ready across multiple regulatory environments.

What you’ll do

• Own and execute security compliance implementation and audits across key frameworks, including SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act, covering control design, framework mapping, gap assessments, evidence collection, and remediation tracking.
• Build and maintain Compliance-as-Code and continuous compliance capabilities such as policy-as-code, automated control validation, continuous evidence pipelines, and monitoring integrated into development and deployment workflows.
• Operate and extend GRC platforms (for example, Vanta) as the system of record for controls, evidence, and audit readiness, including integrations with cloud, identity, and engineering tooling to reduce manual effort.
• Partner with engineering and architecture to embed compliance requirements early in design reviews and translate framework obligations into technical control narratives that meet auditor expectations while supporting delivery.
• Develop, maintain, and continuously improve corporate policies, standards, and procedures that support governance and the AI management system posture.
• Identify, assess, and prioritize risks spanning AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments, and distinguish meaningful risk from compliance theater.
• Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with emphasis on AI system risks including data handling, model governance, and agentic and conversational surfaces.
• Build and maintain relationships with external auditors, assessors (including QSAs where applicable), and regulators, serving as the bridge between external requests and internal teams.
• Champion a security and compliance culture by educating teams on the purpose of controls and supporting practical adoption.

Requirements

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
• 8+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
• Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
• Expert-level working knowledge of several of: SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001, including building and running controls (not only reading the frameworks).
• Experience with Compliance-as-Code practices and GRC automation tooling (for example, Vanta, Drata or similar), with a bias toward continuous monitoring.
• Ability to evaluate control objectives against real IT and cloud configurations and work with engineers on remediation.

Technologies and frameworks you may work with

• SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, EU AI Act
• Compliance-as-Code, policy-as-code, GRC platforms (including Vanta and Drata)
• AWS, GCP, Azure, CI/CD, IAM, logging and monitoring, encryption, infrastructure hardening
• NIST AI RMF, GDPR, CCPA, HIPAA, SOX / ITGC, FedRAMP, NIST 800-171, CMMC

Compensation and benefits

$152,000 - $258,000 USD per year. Base salary is one part of the total rewards package, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.

Additional preferred experience

• 10+ years of security compliance, GRC engineering, or technology audit-related experience.
• Hands-on implementation of technical controls (for example, IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
• Experience in the tech or AI/ML industry, particularly with startups or high-growth product organizations.
• Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
• Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, especially in a publicly traded or IPO-bound company.
• Strong understanding of AI ethics and AI governance frameworks, including NIST AI RMF, ISO 42001, and EU AI Act, and associated operational risks.
• Working knowledge of data privacy frameworks such as GDPR and CCPA in a technology or cloud environment.
• Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar preferred.
• Experience with public sector or federal compliance programs (for example, FedRAMP, NIST 800-171, CMMC) is a plus.

ITAR requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.