SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 166,000 - 253,000 / annual
Anduril Industries, a defense technology company, is seeking a Security Engineer to lead the Governance, Risk, and Compliance (GRC) engineering function. This role involves building the technical core of Anduril's GRC program—creating pipelines and tooling that transform systems into continuous, defensible evidence of compliance, replacing manual audit preparation processes.
Key responsibilities include:
- Designing and building data collection pipelines that gather evidence from Anduril's systems and map it to normalized control models
- Developing reusable collectors and schemas as reference architectures to streamline control implementation
- Establishing the system of record for controls, mappings, and evidence; conducting build-vs-buy analysis
- Identifying control drift and routing findings to system owners with clear remediation and risk-acceptance paths
- Translating compliance frameworks (CMMC, NIST 800-171, FedRAMP/IL5) into automatable technical checks and pass/fail signals
- Setting technical direction and mentoring a growing engineering team
Required qualifications:
- 6+ years in security engineering, GRC, or related roles with hands-on automation or data pipeline experience
- Strong programming ability in general-purpose languages (Go, Python, Rust, etc.)
- Hands-on experience operationalizing compliance frameworks (CMMC, NIST 800-171, 800-53, FedRAMP, SOC 2)
- Experience designing data collection and integration across cloud and SaaS systems (APIs, log/event pipelines, data lakes)
- Production experience with infrastructure as code (Terraform, AWS CDK)
- Track record of setting technical direction and mentoring engineers
- Ability to work autonomously, own ambiguous problems, and drive cross-team alignment
- Eligibility to obtain and maintain U.S. Secret clearance
Preferred qualifications include experience with continuous control monitoring platforms (Vanta, Drata, Hyperproof, OneTrust), security data lakes, log aggregation, STIG/ConMon scanning, CSPM, Kubernetes hardening, and fast-paced defense technology environments.
