SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 130,000 - 150,000 / annual
BETA Technologies is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to build and mature the company's GRC program, initially within Information Security and expanding across enterprise operations including aerospace engineering, manufacturing, supply chain, and defense programs.
This is a hands-on, strategic role for a GRC professional who thrives in a fast-paced, innovative environment where aviation safety, cybersecurity, and regulatory compliance intersect. You will help shape the GRC and information security culture at BETA as the company rapidly scales in the electric aviation sector.
Key Responsibilities:
• Design, implement, and mature GRC frameworks aligned with industry standards (NIST CSF, ISO 27001, CMMC)
• Coordinate internal and external audits, assessments, and certifications (SOC 2, ISO 27001, CMMC)
• Lead buildout of InfoSec GRC capabilities including risk assessments, policy development, compliance management, and security control implementation
• Develop scalable GRC processes, templates, and tools adaptable enterprise-wide
• Conduct comprehensive risk assessments across IT systems, operational technology (OT), and critical business processes
• Develop risk treatment plans and monitor remediation activities to closure
• Translate complex regulatory requirements into actionable control requirements for technical and operational teams
• Monitor regulatory landscape for emerging compliance obligations relevant to electric aviation and defense contracting
• Support control testing and validation activities
• Conduct vendor security assessments and manage vendor compliance documentation and ongoing risk monitoring
• Work across departments (InfoSec, IT, Engineering, Manufacturing, Quality, Legal, Program Management) to embed GRC practices
• Drive continuous improvement of GRC processes based on lessons learned and industry best practices
Requirements:
• 7+ years of hands-on GRC experience, with at least 5 years focused on information security risk and compliance
• Experience managing external audits and assessments (SOC 2, ISO certifications, CMMC assessments) and associated internal preparation
• Deep working knowledge of NIST CSF, NIST 800-53, NIST 800-171, ISO 27001/27002, and risk management methodologies
• Direct experience with compliance frameworks applicable to defense contractors (NISPOM, DFARS, ITAR/EAR, CUI protection)
• Proven track record conducting enterprise risk assessments, threat modeling, and risk quantification
• Experience creating security policies, standards, procedures, and control documentation
• Excellent written and verbal communication skills; ability to translate technical risk to business stakeholders
• Demonstrated ability to influence without authority and build strong cross-functional relationships
• Proficiency with GRC platforms (Vanta, Upguard, etc.) and common collaboration tools (Slack, Jira, Confluence, etc.)
Desired Qualifications:
• One or more professional certifications (CRISC, CISSP, CISA, CISM, or ISO 27001 Lead Auditor)
• Experience working in Defense and Aerospace industry
• Understanding of IT and operational technology/industrial control systems security in manufacturing environments
• Experience implementing or administering GRC platforms and integrated risk management tools
• Track record of building GRC programs from the ground up or through significant maturity transitions
• Familiarity with privacy regulations (GDPR, CCPA) and data protection frameworks
