Security Compliance Audits

Security Compliance Audits Engineer Jobs

3 jobs found

Today

Security Engineer - GRC Frameworks & AI Governance

SpaceXSI Palo Alto, CA

Palo Alto, CA

Today

$100k - $198k/yr Full time Ai Security Cloud Platforms Data Security

Apply Now

Job Description

SpaceXSI is seeking a mid-level Security Engineer focused on GRC frameworks and AI governance to join its security and AI governance team in Palo Alto, CA. This role helps design and implement compliance controls, automate evidence and assurance, and keep AI systems audit-ready across enterprise, commercial, and public-sector environments.

Responsibilities

Execute security compliance implementation and audits across SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, and the EU AI Act, including control design, mapping, gap assessments, evidence collection, and remediation tracking.
Build and maintain Compliance-as-Code and continuous compliance capabilities, including policy-as-code, automated control validation, continuous evidence pipelines, and monitoring integrated into development and deployment workflows.
Operate and extend GRC platforms (for example, Vanta) as the system of record for controls, evidence, and audit readiness, integrating with cloud, identity, and engineering tooling to reduce manual effort.
Partner with engineering and architecture to embed compliance requirements early in design reviews, translating framework obligations into technical control narratives that support auditor expectations.
Develop, maintain, and continuously improve corporate policies, standards, and procedures that support the company’s governance and AI management system posture.
Identify, assess, and prioritize risks across AI/ML operations, cybersecurity, regulatory compliance, data privacy, intellectual property, and cloud deployments, focusing on meaningful business risk versus compliance theater.
Lead risk assessments and compliance reviews for new products, model deployments, features, and architectural changes, with attention to AI system risks such as data handling, model governance, and agentic and conversational surfaces.
Own and cultivate relationships with external auditors, assessors (including QSAs where applicable), and regulators, acting as a bridge between auditors and internal teams.
Champion a companywide culture of security and compliance by educating teams on why controls exist, not only enforcing them.

Requirements

Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
3+ years of experience in GRC, security compliance, or technology audit roles with hands-on GRC engineering responsibilities.
Demonstrated experience implementing and maintaining security compliance frameworks in cloud environments (AWS, GCP, or Azure).
Expert-level working knowledge of SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, and ISO 42001, including building and running controls.
Experience with Compliance-as-Code and GRC automation tooling (such as Vanta or Drata) with a bias toward continuous monitoring.
Ability to evaluate control objectives against real IT and cloud configurations and collaborate with engineers on remediation.

Technologies

SOC 2, NIST CSF, NIST SP 800-53, ISO 27001, ISO 42001, EU AI Act
Compliance-as-Code, policy-as-code, Vanta, Drata
AWS, GCP, Azure
GRC platforms, CI/CD, cloud

Preferred Skills and Experience

5+ years of security compliance, GRC engineering, or technology audit-related experience.
Hands-on experience implementing technical controls such as IAM, logging and monitoring, encryption, and infrastructure hardening, including integration of compliance checks into CI/CD pipelines.
Experience in the tech or AI/ML industry, especially startups or high-growth product organizations.
Working knowledge of HIPAA privacy and security rules (bonus), ideally mapped into a SOC 2 or ISO-certified control environment.
Experience supporting SOX / ITGC design, documentation, testing, or auditor coordination, particularly in a publicly traded or IPO-bound company.
Strong understanding of AI ethics and AI governance frameworks (including NIST AI RMF, ISO 42001, and the EU AI Act) and associated operational risks.
Working knowledge of data privacy frameworks such as GDPR and CCPA in a technology or cloud environment.
Exceptional analytical, problem-solving, organizational, and project management skills to take compliance programs from conception to audit-ready launch.
Excellent communication and stakeholder management, with the ability to explain risk and tradeoffs to engineering, legal, sales, and executives in plain language.
Certifications such as CISSP, CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, or similar preferred.
Public sector or federal compliance experience (such as FedRAMP, NIST 800-171, or CMMC) is a plus.

Compensation

$100,000 - $198,000 USD

Benefits

Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short & long-term disability insurance
Life insurance
Various other discounts and perks

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

Location: Palo Alto, CA (onsite)

Minimum Experience: 3 years

View full job page →

Today

Security Engineer - GRC Federal Frameworks

SpaceXSI Washington, DC

Washington, DC

Today

$100k - $198k/yr Full time Cloud Cmmc Controls Continuous Monitoring

Apply Now

Job Description

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) professional to help scale its security compliance program. This onsite role in Washington, DC focuses on NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 authorization processes, with an emphasis on continuous monitoring artifacts and close partnership with engineering teams to implement and validate controls.

Responsibilities

Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D. (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and Risk Management Framework activities.
Oversee audits, certifications, third-party assessments, and vulnerability management to support sustained compliance and operational credibility.
Design and implement risk mitigation strategies, including monitoring systems, contingency planning, vulnerability scans, Plan of Action and Milestones (POAMs), and STIGs.
Ensure security configurations, practices, and procedures are implemented, monitored, and maintained across the project lifecycle.
Act as a liaison between system owners, security personnel, and cross-functional teams to support communication, collaboration, and control implementation.
Lead Risk Management Assessment and Authorization (A& A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process improvements.
Perform regular risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
Serve as a subject matter expert on risk, compliance, and cybersecurity matters; translate business and technical risk for leadership.
Create and present recurring reports on GRC performance, risks, and compliance status for senior leadership and stakeholders.

Required Qualifications

Bachelor’s degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
3+ years of experience in governance, risk management, compliance, or technology audit roles.
At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
Experience implementing and maintaining security compliance frameworks and cloud security controls.
Expert-level knowledge in at least one domain: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D., and/or NIST 800-171/CMMC.

Relevant Technologies

NIST Risk Management Framework (RMF)
FedRAMP
Impact Level 4/5 (IL4/IL5)
DoD Cloud Computing SRG IL5/IL6
FedRAMP Class D. (Rev. 5 / CR2026)
NIST 800-53
NIST 800-171/CMMC
Plan of Action and Milestones (POAMs)
STIGs
Risk Management Assessment and Authorization (A& A)
Continuous Monitoring

Preferred Skills and Experience

5+ years of security compliance or technology audit-related experience.
Hands-on experience implementing technical controls (e.g., IAM, logging and monitoring, encryption, infrastructure hardening) and integrating compliance checks into CI/CD pipelines.
Strong analytical, problem-solving, organizational, and project management capabilities, including balancing innovation, oversight, and delivery from concept to launch.
Ability to evaluate control objectives with IT configurations.
Hands-on experience implementing technical controls, not solely assessing them.
Experience in the tech or AI industry, especially with startups or innovative organizations.
Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code (e.g., policy-as-code frameworks like OPA), automated control validation, and continuous compliance monitoring integrated into the deployment pipeline.
Excellent communication and stakeholder management skills, including translating risks to leadership and influencing cross-functional teams.
Experience with commercial compliance programs (e.g., ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar) is a plus.

Benefits

Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short and long-term disability insurance
Life insurance
Various other discounts and perks

Compensation and Location

Location: Washington, DC (onsite)
Salary: USD 100,000 to 198,000 per year

ITAR Requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

View full job page →

8d ago

Infrastructure Security Engineer

SpaceXSI Washington, DC

Washington, DC

8d ago

$100k - $258k/yr Full time Aws Cloud Security Azure Cloud Security Cloud Native Security

Apply Now

Job Description

SpaceXSI is seeking an Infrastructure Security Engineer to help secure cloud-native application ecosystems spanning multi-cloud and hybrid infrastructure. This role focuses on building reliable security foundations, automating controls, and ensuring that critical environments meet security and regulatory expectations from design through operations.

Working onsite in Washington, DC, you will design secure architectures across cloud platforms, harden infrastructure and containers, and integrate security into delivery pipelines. The position emphasizes infrastructure-as-code, security operations, and proactive ownership of end-to-end security projects.

Responsibilities

Design and implement secure cloud architectures across multiple cloud platforms, including AWS, GCP, and Azure
Build and secure mission-critical applications in hybrid cloud and on-premises environments
Develop and maintain Infrastructure as Code (IaC) templates with embedded security controls
Support regular security assessments and audits of cloud infrastructure and services
Implement and manage cloud security tools and services such as CSPM, CWPP, and CASB
Manage identities and roles across cloud and hybrid environments
Monitor and remediate infrastructure to comply with regulations and best practices including PCI, NIST CSF, GDPR, and HIPAA
Design and implement secure container standards and automation that support developer workflows
Maintain Kubernetes security aligned with current best practices
Collaborate with development teams to integrate security best practices into CI/CD pipelines
Secure and enhance CI/CD pipelines, including integration and maintenance of code scanning platforms
Monitor and respond to security events and incidents in cloud and hybrid environments
Maintain SIEM data pipelines needed for reliable alerting
Build, deploy, and maintain security operations infrastructure using Python, Terraform, and configuration management such as Puppet
Develop dashboards and alerts from security metrics
Develop and maintain cloud security policies, standards, and procedures
Own security projects end to end by identifying issues and implementing solutions
Stay current with emerging cloud security threats and mitigation strategies

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, or a related field
3–5 years of experience in cloud security, infrastructure security, or related roles
Strong understanding of cloud security principles, compliance frameworks, and best practices
Proficiency in at least one cloud platform: AWS, GCP, or Azure, and its security services
Proven experience securing hybrid AWS/on-premises (or multi-cloud) environments, including IAM and overall security posture
Experience with Infrastructure as Code tools such as Terraform and CloudFormation
Familiarity with containerization technologies and related security implications
Knowledge of network security concepts and protocols
Experience with scripting languages such as Python and Bash for automation and tool development
Proactive mindset with strong ownership, critical thinking, and problem-solving skills
Located in the SF Bay Area or willing to relocate

Technologies

AWS, GCP, Azure
Infrastructure as Code (IaC), Terraform, CloudFormation
CSPM, CWPP, CASB
PCI, NIST CSF, GDPR, HIPAA
Kubernetes
CI/CD pipelines
SIEM
Python, Puppet, Bash
CloudWatch, Prometheus, Grafana, Wazuh
GitHub Actions, Karma

Compensation and Benefits

Compensation: $100,000 - $258,000 USD per year
Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short and long-term disability insurance
Life insurance
Various other discounts and perks

Preferred Skills and Experience

Relevant security certifications such as CCSP, CSSK, or AWS Security Specialty
Deep expertise in Kubernetes and container security
Experience with multi-cloud environments and cloud-to-cloud security
Knowledge of CI/CD best practices and tools
Familiarity with regulatory compliance requirements including GDPR, HIPAA, PCI DSS, and NIST CSF
Strong proficiency with Python, Terraform, and configuration management such as Puppet
Hands-on experience building GitHub Actions and workflows
Experience with observability and security operations tooling such as Prometheus, Grafana, CloudWatch, Karma, and SIEM platforms such as Wazuh
Experience building custom cloud security tools or integrations
Interest in leveraging AI for cloud security monitoring and automation
Contributions to open-source cloud security projects
Experience with securing AI/ML workloads in cloud environments
Experience in banking, money transmission, P2P payments, or similarly regulated financial platforms

View full job page →

Security Compliance Audits Engineer Jobs

Security Engineer - GRC Frameworks & AI Governance

Security Engineer - GRC Federal Frameworks

Infrastructure Security Engineer

Get Security Compliance Audits Engineer Jobs alerts