Director, Governance, Risk & Compliance

Apex Technology, Inc.•Los Angeles, CA

14h•$200,000 - $250,000

About The Position

Apex is hiring a Director, Governance, Risk & Compliance (GRC) to own the company’s GRC posture end to end and build the function that keeps Apex audit-ready across its applicable frameworks. This player-coach role owns the GRC program, including control frameworks, risk management, audits, assessments, and compliance evidence, while building and leading the team responsible for sustaining it. The Director directly manages an Information System Security Officer (ISSO) and Information System Security Manager (ISSM), setting priorities, developing their careers, and maintaining standards required for authorizations and certifications. Reporting to the Director of Cybersecurity, the role connects security, legal, engineering, IT, and program teams. Apex’s obligations span government and defense requirements (NIST SP 800-171, CMMC, FedRAMP), commercial security (SOC 2, ISO 27001), export and trade controls (ITAR/EAR), and data privacy (GDPR, CCPA). The Director is accountable for bringing these obligations together into a coherent, continuously maintained program. Apex manufactures satellite buses at scale using software, vertical integration, and hardware designed for manufacturing. Its spacecraft support applications including Earth observation and communications. The company describes itself as a fast-growing startup with more than $500 million in funding and highlights the opportunity to work in person at its Playa Vista office, with flexibility to integrate work and life.

Requirements

At least 8 years of experience in governance, risk, and compliance, information security, or a closely related field, including direct ownership of a GRC or security compliance program.
Experience leading and managing people, including building, managing, or mentoring security or compliance staff, and readiness to manage an ISSO and ISSM as direct reports.
Deep, hands-on knowledge of NIST SP 800-171 and NIST frameworks, including 800-53 and RMF/CSF, with practical experience in CMMC and/or FedRAMP authorization work.
Demonstrated ownership of SOC 2 and/or ISO 27001 commercial security certifications from scoping through audit and certification.
Working familiarity with ITAR/EAR export control and GDPR/CCPA privacy obligations, and how they translate into technical and administrative controls.
Proven ability to manage audits and assessments end to end and produce evidence and documentation that withstand external scrutiny.
Strong cross-functional communication skills, including the ability to translate between regulators, auditors, engineers, and executives while maintaining precision.
U.S. Person status is required because the position needs access to export-controlled data. The posting’s ITAR information states that eligibility may also be met by being able to obtain required export authorizations from applicable U.S. government agencies.

Nice To Haves

J.D. law degree or master’s degree in public policy.
Experience in aerospace, defense, space, or another regulated hardware or manufacturing environment.
Active or prior U.S. government security clearance.
Relevant certifications such as CISSP, CISM, CRISC, CISA, or CCSP.
Experience establishing a GRC program or control framework from the ground up in a high-growth company.
Familiarity with GRC tools and automated evidence-collection or continuous-monitoring platforms.
Experience building compliance for a product or platform that is sold or licensed to customers.

Responsibilities

Own Apex’s GRC program end to end and establish and maintain the control frameworks, policies, standards, and procedures that govern how the company secures its systems and data.
Lead, manage, and mentor the GRC team, including direct-report ISSO and ISSM; set priorities, define ownership, and develop the team’s capabilities as the program scales.
Drive compliance with NIST SP 800-171, CMMC, and FedRAMP, including SSP and POA&M development, control implementation, continuous monitoring, and audit and assessment readiness.
Own the SOC 2 Type II and ISO 27001 certification roadmap, including scoping, evidence collection, auditor relationships, remediation, certification, and renewal.
Partner with Legal and Trade Compliance on ITAR/EAR export controls and with Privacy stakeholders on GDPR/CCPA obligations, ensuring technical and administrative controls map to regulatory requirements.
Build and run enterprise risk management, maintain the risk register, lead risk assessments, drive remediation to closure, and report residual risk to leadership in actionable terms.
Manage internal, customer, and third-party audit and assessment lifecycles as the primary point of contact, owning evidence, narratives, and corrective actions.
Establish and maintain a centralized control framework that reduces duplicated requirements across regimes so one set of controls can satisfy multiple obligations.
Run the vendor and third-party risk program, assessing suppliers and partners against Apex’s security and compliance requirements.
Provide clear, decision-ready reporting to the Director of Cybersecurity and executive stakeholders on compliance status, risk posture, and audit outcomes.

Benefits

Equity in Apex.
Company-paid medical, dental, and vision coverage for employees and dependents.
$100,000 life insurance at no cost.
15 days of vacation initially, increasing to 20 or more days annually.
10 paid holidays.
401(k) plan with a 100% match on the first 3% and a 50% match on the next 2%.
Eight weeks of paid parental leave.
Childcare reimbursement up to $350 per day for work-related travel.
Daily catered lunch and unlimited snacks.
Office socials, pickleball tournaments, run club, and gatherings for employees and their families.
Tools for an individualized desk setup.
In-person collaboration at the Playa Vista office, with flexibility to integrate work and life.
Long-term incentives in the form of stock options for full-time hires.