Security Engineer - GRC Sales

SpaceXSI•Washington, DC

2d•$100,000 - $258,000

About The Position

SpaceXSI is seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management and customer trust. The role combines cybersecurity GRC, vendor management, and sales enablement. The Security Engineer will support sales as a security-minded presales partner, build sufficient technical knowledge of the SpaceXSI environment to complete customer security assessments accurately, participate in customer meetings as a security and compliance subject matter expert, and help operate third-party risk and vendor management processes. The successful candidate will understand how AI and LLM systems, CI/CD pipelines, identity and access management, DevOps and DevSecOps, Kubernetes, and IT and AI governance work in production. They will translate that understanding into credible, clear responses for enterprise customers while maintaining accuracy and avoiding unsupported claims about SpaceXSI’s security posture. The role may also include additional tasks and responsibilities as needed to support the team and evolving business priorities.

Requirements

Bachelor's degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
At least 5 years of experience in cybersecurity, GRC, third-party risk management, security assurance, or a closely related role with customer-facing or sales-adjacent responsibilities.
Demonstrated experience completing or owning customer vendor security questionnaires and participating in security due-diligence discussions with enterprise buyers.
Working technical fluency in several of the following: AI/LLM or ML platforms, CI/CD pipelines, identity and access management, DevOps/DevSecOps, Kubernetes, and cloud environments such as AWS, GCP, or Azure; sufficient to understand control implications and communicate credibly with engineers and customers.
Solid understanding of common security and compliance frameworks used in customer assurance, such as SOC 2, ISO 27001, and NIST CSF, and how controls map to questionnaire language.
Strong written and verbal communication skills, including the ability to explain cybersecurity and GRC concepts to sales, customers, legal, and engineering audiences.

Nice To Haves

7 or more years of cybersecurity, GRC, third-party risk, or customer trust/security assurance experience.
Experience in presales security, security solutions engineering, customer trust, or sales-enablement GRC at a technology, cloud, or AI company.
Hands-on or closely related experience with vendor risk management programs, including onboarding assessments, continuous monitoring, contract security exhibits, and residual-risk reporting.
Familiarity with AI governance topics relevant to customer diligence, such as model data handling, prompt/output controls, training-data boundaries, ISO 42001, NIST AI RMF concepts, or EU AI Act awareness.
Experience maintaining a Trust Center, security FAQ library, or questionnaire knowledge base; familiarity with GRC platforms such as Vanta or Drata.
Ability to read architecture diagrams, IAM models, and high-level pipeline or Kubernetes designs and turn them into accurate, plain-language customer narratives.
Comfort working in fast-moving deal cycles while preserving accuracy, including knowing when to confirm details with engineering.
Working knowledge of data privacy frameworks such as GDPR and CCPA as they appear in enterprise security and vendor assessments.
Certifications such as CISSP, CISA, CISM, CRISC, CTPRP, CIPT, CIPP/US, or similar.
Experience supporting public sector, financial services, or other highly regulated customer diligence processes.

Responsibilities

Support sales as a cybersecurity and GRC presales partner by attending customer and prospect meetings, presenting the security and compliance posture, and answering technical and control-related questions accurately.
Own and improve responses to customer vendor security questionnaires, RFPs, SIG/CAIQ-style assessments, and due-diligence requests; maintain a reusable knowledge base of control narratives grounded in SpaceXSI's operations.
Build and maintain working fluency across SpaceXSI's AI/LLM systems and model governance, CI/CD pipelines, identity and access management, DevOps and DevSecOps practices, Kubernetes platforms, and IT and AI governance; answer customer questions and escalate to engineering when appropriate.
Partner with Engineering, Security, Legal, and Product to keep questionnaire content, Trust Center materials, and security collateral current as architecture, controls, and certifications evolve.
Translate customer security requirements into actionable internal requests and help distinguish necessary contractual or control commitments from unreasonable or out-of-scope demands.
Contribute to policies, standards, and procedures related to third-party risk, customer assurance, and vendor security due diligence.
Coordinate with GRC and security teams on overlapping frameworks and evidence, including SOC 2, ISO 27001, ISO 42001, and privacy commitments, to keep external answers consistent with internal controls and GRC tooling such as Vanta.
Identify recurring customer questionnaire patterns and deal blockers, and share insights with product, engineering, and GRC roadmaps to reduce friction over time.
Create and present concise status updates on questionnaire volume, deal-impacting security requests, vendor risk posture, and emerging customer assurance themes to sales leadership and GRC stakeholders.
Promote clear and honest customer communication about security practices, AI and infrastructure governance, and intentionally scoped risks.