Bachelor's degree in a technical field or equivalent experience
5+ years in GRC or compliance within DoD or military contexts
In-depth knowledge of NIST, ISO standards, and compliance frameworks
Familiarity with Operational Technology/Industrial Control Systems security
Experience in facilitating third-party audits from start to finish
Proficiency in designing custom security controls rather than generic solutions
Experience in implementing GRC tools and workflows
Responsibilities
Own cross-department risk assessments and manage a centralized risk register
Design an original control framework tailored to CHOAS operations
Write forward-thinking security policies that enhance compliance and maturity
Manage GRC tools for risk assessment and control performance
Coordinate and support during audits, including preparation and evidence collection
Bridge communication between departments to create and execute security requirements
Report on risk posture, audit outcomes, and program effectiveness to stakeholders
Benefits
100% medical, dental, and vision benefits covered by the company
401k plan with a 50% match up to 6% of pay
Flexible Spending Account (FSA) and Health Savings Account (HSA) options
Life insurance and additional perks
Free daily lunch and 'No meeting Fridays'
Unlimited paid time off and casual dress code
Opportunities for stock options as part of pre-IPO compensation
Full Job Description
Role Overview:
Own and mature the CHAOS Industries cybersecurity GRC program by establishing governance structure, policies, standards, expectations, and accountability across CHAOS businesses.
You'll report to the IT/Cybersecurity Program Director and work daily with IT, Cybersecurity, Physical Security, and Manufacturing - teams with different priorities and vocabulary; therefore, you'll spend real time translating broad requirements into controls people adopt.
Build and manage cybersecurity risk processes, including risk registers, findings, vulnerabilities, remediation plans, ownership, escalation, and business acceptance.
If you enjoy designing frameworks that fit the organization rather than forcing the organization to fit a template, and you want direct input into how a defense company governs risk, this is the seat.
Responsibilities:
Own risk assessments across several departments and maintain the centralized risk register.
Design and maintain a unified, original control framework tailored to CHAOS Industries' operating environment, including a security-by-design approach to systems development and defined: Maximum Tolerable Downtime (MTD), Recovery Point Objective (RPO), and Recovery Time Objective (RTO) for critical systems.
Write and maintain policy that goes beyond minimum mandatory compliance, building genuine security maturity rather than satisfying the floor of any one requirement.
Manage GRC tooling and related workflows to support risk assessments, control monitoring, and reporting.
Prepare for, coordinate, and help run third-party and certification audits, including evidence collection, gap assessments, and auditor liaison.
Act as the connective tissue between different department to then develop security and compliance requirements for partner teams and drive them to execution.
Report regularly to the Program Director and executive stakeholders on risk posture, audit status, and program maturity.
Onsite presence required 4 days per week.
Travel: up to 25%, primarily to support Manufacturing and Physical Security control validation across company sites.
Physical demands: occasional access to manufacturing floor environments, including required PPE and periods of standing or walking during facility walkthroughs.
Support customer, vendor, supplier, and subcontractor cybersecurity risk management, including questionnaires, contract reviews, security expectations, and customer-facing services.
Coordinate cybersecurity audits, assessments, evidence requests, customer reviews, and remediation tracking in partnership with Legal, Compliance, commercial teams, IT, and business leaders.
Minimum Requirements:
Bachelor's degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field, or equivalent practical experience.
Deep knowledge of NIST CSF, NIST RMF, the ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53.
Experience selecting, implementing, or administering GRC tooling and workflows.
Exposure to widely recognized governance, risk, and compliance frameworks spanning security, privacy, and quality management domains.
Familiarity with OT/ICS security concepts.
Minimum of 5 years hands-on GRC or compliance experience combined with prior experience in a DoD environment or military service.
Has directly supported a third-party or certification audit from evidence collection through closure.
Can apply recognized governance, risk, and compliance frameworks well enough to design real, working controls tailored to a specific organization, not just describe them generically.
Has performed or directly supported a formal risk assessment (identification, scoring, and treatment) using a defined methodology.
Preferred Requirements:
Experience supporting third-party audits in a cloud-centric environment.
Has built or materially contributed to a risk register, control framework, or compliance program, not only operated within one already established elsewhere.
Has written policy or procedure documentation that a non-security audience could follow and act on.
Why CHAOS?
Health Benefits: Medical, dental, and vision benefits 100% paid for by the company
Additional benefits: 401k (+ 50% company match up to 6% of pay), FSA, HSA, life insurance, and more
