Security Engineer-Governance, Risk & Compliance

AirLife•Grand Rapids, MI

6h•Remote

About The Position

The Security Engineer – Governance, Risk & Compliance is responsible for establishing and maturing AirLife's information security risk management and compliance posture. This role evaluates, quantifies, and helps mitigate security risks across IT infrastructure and business systems, while ensuring AirLife's cybersecurity practices remain aligned to applicable regulatory frameworks, industry standards, and internal policies. Operating in a medical device manufacturing environment with FDA and ISO regulatory obligations and a PE ownership structure with specific cybersecurity reporting requirements, this role brings both technical security knowledge and a compliance mindset to a rapidly maturing IT security program. The Security Engineer – GRC plays a critical role in AirLife's ability to satisfy external auditors, insurance underwriters, and PE sponsor security benchmarking requirements.

Requirements

Strong working knowledge of security risk management frameworks and methodologies, including NIST CSF, NIST SP 800-30/37, ISO 27001, and CIS Controls.
Understanding of regulatory compliance requirements relevant to medical device manufacturing, including FDA 21 CFR Part 820 / QMSR and ISO 13485, and their implications for IT General Controls (ITGC) and computer system validation.
Experience with IT General Controls frameworks and audit support, including SOX-adjacent controls applicable to PE-backed manufacturing companies.
Knowledge of data privacy regulations, including GDPR and applicable US state privacy laws, and their operational IT implications.
Experience conducting risk assessments, gap analyses, and security control reviews; ability to document, prioritize, and track findings through to remediation.
Experience developing and maintaining security policies, standards, procedures, and control evidence libraries.
Familiarity with vulnerability management programs, including scanning tooling, remediation tracking, and risk-based prioritization.
Experience administering security awareness training programs, including phishing simulation and completion tracking (KnowBe4 experience preferred).
Ability to work with MDR/MSSP providers to ensure managed detection capabilities align with AirLife's compliance posture (Arctic Wolf experience a plus).
Strong written communication skills; ability to clearly document findings, prepare audit evidence packages, and present risk posture to non-technical audiences including executives and external auditors.
Proficiency with project and task management tools; Smartsheet experience preferred.
Minimum 4–6 years of IT experience with 3+ years in a cybersecurity role with a GRC, compliance, or risk management focus.
Experience in a regulated manufacturing, medical device, or life sciences environment strongly preferred.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent experience.

Nice To Haves

KnowBe4 experience preferred.
Arctic Wolf experience a plus.
Smartsheet experience preferred.
Industry-recognized GRC or cybersecurity certification(s) preferred (CISA, CRISC, CompTIA Security+, SSCP, or equivalent).
GRC-relevant certification(s) preferred.

Responsibilities

Develop, implement, and maintain AirLife's information security policies, standards, and procedures, ensuring they remain current, compliant with applicable frameworks, and operationally effective for the teams they govern.
Conduct and facilitate periodic security risk assessments and gap analyses across IT infrastructure, business applications, and operational technology, documenting findings, quantifying risk, and recommending prioritized remediation measures to IT leadership.
Own AirLife's security compliance posture across applicable frameworks (NIST CSF, CIS Controls, ISO 27001, GDPR), including control documentation, evidence collection, ongoing compliance monitoring, and management of compliance calendars.
Support IT General Controls (ITGC) compliance, including access control review coordination, change management process documentation, and preparation and management of audit evidence packages for internal and external auditors.
Partner with QA/RA and Legal & Compliance to ensure IT security controls are appropriately aligned to AirLife's 21 CFR Part 820 / QMSR and ISO 13485 obligations, particularly as they relate to computer system validation and access control in regulated processes.
Own and administer AirLife's security awareness and compliance training program, including planning and coordinating KnowBe4 phishing simulation and training campaigns, tracking completion rates across departments, and reporting to IT leadership on compliance status.
Maintain and improve AirLife's vulnerability management program, including scheduling assessments, tracking and prioritizing remediation, and reporting vulnerability posture and trends to IT leadership.
Support Frazier Partners' cybersecurity benchmarking and reporting requirements; coordinate with Lockton for cyber insurance assessment preparation and supply requested security metrics, documentation, and evidence as required.
Collaborate with Arctic Wolf and other managed security service providers to ensure managed services are operating in alignment with AirLife's compliance posture, risk appetite, and applicable regulatory requirements.
Maintain, test, and continuously improve the IT Cyber Incident Response Playbook; support the planning and facilitation of tabletop exercises; assist in incident response coordination and post-incident review when security events occur.
Serve as the IT security subject matter expert for IT-related internal and external audits: prepare evidence packages, coordinate audit interviews, manage finding responses, and own remediation tracking through closure (including all enterprise applications and segregation-of-duties findings).
Build and maintain a comprehensive GRC documentation library, including the risk register, control matrix, policy library, compliance calendar, and audit history, ensuring currency and accessibility for authorized stakeholders.