Responsibilities

We are hiring a Director, Governance, Risk & Compliance (GRC) to own that posture end to end and build the function that keeps Apex audit-ready across every framework our business depends on.
This is a player-coach leadership role. You will personally own our GRC program — control frameworks, risk management, audits, assessments, and the body of evidence that proves our compliance — while building and leading the team that sustains it. You will directly manage an Information System Security Officer (ISSO) and Information System Security Manager (ISSM), setting their priorities, developing their careers, and holding the line on the standards our authorizations and certifications require.
Own Apex's GRC program end to end, establish and maintain the control frameworks, policies, standards, and procedures that govern how the company secures its systems and data.
Lead, manage, and mentor the GRC team, including a direct-report ISSO and ISSM; set priorities, define ownership, and grow the team's capability as the program scales.
Drive compliance against government and defense requirements — NIST SP 800-171, CMMC, and FedRAMP — including SSP and POA&M development, control implementation, continuous monitoring, and audit/assessment readiness.
Own the commercial security certification roadmap (SOC 2 Type II, ISO 27001), managing scoping, evidence collection, auditor relationships, and remediation to certification and renewal.
Partner with Legal and Trade Compliance on export control (ITAR/EAR) and with Privacy stakeholders on GDPR/CCPA obligations, ensuring technical and administrative controls map cleanly to regulatory requirements.
Build and run the enterprise risk management process: maintain the risk register, lead risk assessments, drive remediation to closure, and report residual risk to leadership in terms the business can act on.
Manage the full audit and assessment lifecycle — internal, customer, and third-party — serving as the primary point of contact and owning the evidence, narratives, and corrective actions.
Establish and maintain a centralized control framework that de-duplicates overlapping requirements across regimes, so a single set of controls satisfies many obligations.
Run the vendor and third-party risk program, assessing suppliers and partners against Apex's security and compliance requirements.
Deliver clear, decision-ready reporting to the Director of Cybersecurity and executive stakeholders on compliance status, risk posture, and audit outcomes.

Qualification

8+ years in governanceDeepExperience in aerospaceActive or prior URelevant certifications such as CISSP

Required

8+ years in governance, risk, and compliance, information security, or a closely related field, including direct experience owning a GRC or security compliance program.
Experience leading and managing people — you have built, managed, or mentored security/compliance staff and are ready to own an ISSO and ISSM as direct reports.
Deep, hands-on knowledge of NIST SP 800-171 and the NIST frameworks (800-53, RMF/CSF), with practical experience in CMMC and/or FedRAMP authorization work.
Demonstrated ownership of commercial security certifications — SOC 2 and/or ISO 27001 — from scoping through audit and certification.
Working familiarity with export control (ITAR/EAR) and data privacy (GDPR, CCPA) obligations, and how they translate into technical and administrative controls.
Proven ability to manage audits and assessments end to end and to build the evidence and documentation that withstands external scrutiny.
Strong cross-functional communication skills — able to translate between regulators, auditors, engineers, and executives without losing precision.
U.S. Person status is required as this position needs to access export-controlled data.

Preferred

J.D. law degree or master's degree in public policy
Experience in aerospace, defense, space, or another regulated hardware/manufacturing environment.
Active or prior U.S. government security clearance.
Relevant certifications such as CISSP, CISM, CRISC, CISA, or CCSP.
Experience standing up a GRC program or control framework from the ground up in a high-growth company.
Familiarity with GRC tooling and automated evidence-collection / continuous-monitoring platforms.
Experience building compliance for a product or platform that is itself sold or licensed to customers.
Apex believes in creating a work environment that you look forward to embracing every day. Our employees love working at Apex, and we want you to love it too. We're a fast-growing startup that has raised more than $500M in funding, and we invest heavily in our people from day one.

Director, Governance, Risk & Compliance at Apex Technology Inc · LumiJobs

Director, Governance, Risk & Compliance

Responsibilities

Qualification

Required

Preferred

Benefits

Company

Apex Technology Inc

More roles at Apex Technology Inc