Security Engineer - GRC Federal Frameworks

SpaceXSI•Washington, DC

2d•$100,000 - $198,000

About The Position

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) team member to scale its GRC program as the organization grows. The role helps ensure that SpaceXSI operates within regulatory, ethical, and operational boundaries while fostering integrity and resilience. The position focuses on deep expertise in the NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 (IL4/IL5) authorization processes. The successful candidate will apply these frameworks throughout the authorization and certification lifecycle, manage and maintain Continuous Monitoring artifacts and annual assessments for Grok for Government, and work directly with engineers to interpret, design, implement, and validate security controls.

Requirements

Bachelor's degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
At least 3 years of experience in governance, risk management, compliance, or technology audit roles.
At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
Experience implementing and maintaining security compliance frameworks and cloud security controls.
Expert-level knowledge in at least one of these domains: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D, or NIST 800-171/CMMC.

Nice To Haves

5 or more years of security compliance or technology audit-related experience.
Hands-on experience implementing technical controls, such as IAM, logging and monitoring, encryption, and infrastructure hardening.
Experience integrating compliance checks into CI/CD pipelines.
Strong analytical, problem-solving, organizational, and project management skills, including the ability to balance innovation and oversight and take projects from conception to launch.
Ability to evaluate control objectives against IT configurations.
Experience in the technology or AI industry, particularly with startups or innovative organizations.
Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code, policy-as-code frameworks such as OPA, automated control validation, and continuous compliance monitoring integrated into deployment pipelines.
Excellent communication, stakeholder management, and translation skills, including experience influencing cross-functional teams and communicating risks to leadership.
Experience with commercial compliance programs such as ISO 27001, ISO 42001, SOC 2, NIST CSF, NIST 800-53, or similar frameworks.

Responsibilities

Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and the Risk Management Framework.
Oversee audits, certifications, third-party assessments, and vulnerability management to maintain compliance and operational credibility.
Design and implement risk mitigation strategies, including monitoring systems, contingency plans, vulnerability scans, Plans of Action and Milestones (POAMs), and STIGs.
Ensure security configurations, practices, and procedures are implemented, overseen, monitored, and maintained throughout the project lifecycle.
Liaise between system owners, security personnel, and cross-functional teams to facilitate communication, collaboration, and control implementation.
Lead Risk Management Assessment and Authorization (A&A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process enhancements.
Conduct risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
Provide subject-matter expertise and guidance on risk, compliance, and cybersecurity; translate business and technical risks for leadership.
Create and present regular reports on GRC performance, risks, and compliance status to senior leadership and stakeholders.
Manage and maintain Continuous Monitoring artifacts and annual assessments for Grok for Government.
Partner directly with engineers to design, implement, and validate security controls.