Security Engineer - GRC Federal Frameworks

xAI•Austin, NY

About The Position

SpaceXSI is seeking an experienced Governance, Risk, and Compliance (GRC) team member to help scale its GRC program. The role helps ensure SpaceXSI operates within regulatory, ethical, and operational boundaries while fostering integrity and resilience. Its primary focus is deep expertise in the NIST Risk Management Framework (RMF), FedRAMP, and Impact Level 4/5 (IL4/IL5) authorization processes. The successful candidate will apply these frameworks throughout the authorization and certification lifecycle and understand their technical implementation. The role also manages and maintains Continuous Monitoring artifacts and annual assessments for Grok for Government, interpreting control requirements and working directly with engineers to design, implement, and validate controls.

Requirements

Bachelor's degree in computer science, Information Security, Cybersecurity, or an engineering/STEM field.
At least 3 years of experience in governance, risk management, compliance, or technology audit roles.
At least 1 year of experience with FedRAMP/IL5 compliance, vulnerability management, and continuous monitoring.
Experience implementing and maintaining security compliance frameworks and cloud security controls.
Expert-level knowledge in at least one of the following: DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D, or NIST 800-171/CMMC.

Nice To Haves

5 or more years of security compliance or technology audit-related experience.
Hands-on experience implementing technical controls such as IAM, logging and monitoring, encryption, and infrastructure hardening, and integrating compliance checks into CI/CD pipelines.
Strong analytical, problem-solving, organizational, and project management skills, including the ability to balance innovation and oversight and take projects from conception to launch.
Ability to evaluate control objectives against IT configurations.
Experience in the technology or AI industry, particularly with startups or innovative organizations.
Experience with CI/CD pipelines and DevSecOps practices, including compliance-as-code, policy-as-code frameworks such as OPA, automated control validation, and continuous compliance monitoring integrated into deployment pipelines.
Strong communication, stakeholder management, and translation skills, including experience influencing cross-functional teams and communicating risks to leadership.
Experience with commercial compliance programs or frameworks such as ISO 27001, ISO 42001, SOC 2, NIST CSF, or NIST 800-53.

Responsibilities

Execute security compliance implementation and audits, including DoD Cloud Computing SRG IL5/IL6, FedRAMP Class D (Rev. 5 / CR2026), NIST 800-53, NIST 800-171/CMMC, and the Risk Management Framework.
Oversee audits, certifications, third-party assessments, and vulnerability management to maintain compliance and operational credibility.
Design and implement risk mitigation strategies, including monitoring systems, contingency plans, vulnerability scans, Plan of Action and Milestones (POAMs), and STIGs.
Ensure security configurations, practices, and procedures are implemented, overseen, monitored, and maintained throughout the project lifecycle.
Liaise with system owners, security personnel, and cross-functional teams to facilitate communication, collaboration, and control implementation.
Lead Risk Management Assessment and Authorization (A&A) processes, cloud system risk assessments, compliance reviews for new products, changes, and features, and process enhancements.
Conduct risk assessments, scenario analyses, and proactive evaluations of emerging threats, certifications, requirements, and technologies in the AI landscape.
Provide subject-matter guidance on risk, compliance, and cybersecurity, translating business and technical risks for leadership.
Create and present regular reports on GRC performance, risks, and compliance status to senior leadership and stakeholders.
Manage and maintain Continuous Monitoring artifacts and annual assessments for Grok for Government.
Partner with engineers to design, implement, and validate controls.