[Remote] Lead GRC Security Engineer

Note: The job is a remote job and is open to candidates in USA. Lorien is offering a Security Engineering Lead role supporting a defense technology customer. The role will lead the technical roadmap for governance, risk, and compliance engineering, build automated compliance evidence pipelines and validations, and guide an expanding engineering team.

Responsibilities

• Set the technical roadmap for the function and coach an expanding engineering team
• Establish the technical foundation of the GRC program, engineering the pipeline and tooling that convert internal systems into continuous, audit-ready compliance evidence, eliminating the last-minute crunch that typically happens when audits arrive
• Convert regulatory frameworks (CMMC, NIST 800-171, FedRAMP/IL5) into automated technical validations with clear pass/fail outcomes
• Develop the pipeline that gathers evidence across internal systems and aligns it to a standardized control model
• Create the authoritative system of record for controls, mappings, and evidence, while leading the build-versus-buy decision-making process
• Identify control drift and escalate findings to the relevant system owners, providing clear paths for remediation or formal risk acceptance
• Design reusable collectors and schemas as standard reference architectures, so onboarding each new control becomes a matter of assembly rather than starting from scratch

Skills

• Solid coding skills in at least one general-purpose programming language (such as Go, Python, or Rust)
• Background working with security data lakes, log aggregation systems, or building queryable data marts
• Direct, hands-on experience putting compliance frameworks into practice (CMMC, NIST 800-171, 800-53, FedRAMP, SOC 2)
• Comfortable operating independently, taking ownership of undefined problems, and building consensus across partner teams
• Familiarity with continuous control monitoring tools or GRC platforms (Vanta, Drata, Hyperproof, OneTrust), or experience building custom equivalents in-house
• Production-level experience with infrastructure-as-code tooling (e.g., Terraform, AWS CDK)
• 6+ years working in security engineering, GRC, or an adjacent role, with real experience building automation or data pipelines
• Working knowledge of STIG/ConMon scanning, CSPM tooling, or Kubernetes hardening practices
• Experience architecting data collection and integration across cloud and SaaS environments (APIs, log/event pipelines, data lakes)
• Demonstrated history of guiding technical direction and mentoring engineering talent
• Background operating in fast-moving, high-growth defense technology settings
• Must qualify to obtain and hold a U.S. Secret-level security clearance

Benefits

• Onsite in Orange County, CA (or fully remote)

Company Overview