{"id":3948116,"url":"https://alion.io/job/nominal-grc-lead","title":"GRC Lead","company":{"id":63575,"name":"Nominal","domain":"nominal.io","url":"https://alion.io/company/nominal","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gem","truth_index":{"grade":"A","score":87,"open_postings":23,"ghost_share":0,"stale_share":0.522,"repost_share":0,"time_to_fill_p50_days":57,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":208000,"max":245000,"currency":"USD","period":"year","gross":null,"usd_annual":245000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CMMC","optional":false},{"name":"FedRAMP","optional":false},{"name":"NIST 800-171","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-11-06T04:53:02Z","employer_posted_date":"2026-11-08","last_verified_at":"2026-11-08T23:16:25Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"About Nominal\nEngineers today are building some of the most ambitious machines humanity has ever seen. They should have AI that’s purpose-built for them.\nNominal is building the Hardware Intelligence Platform that gives engineers increased visibility into complex physical systems, helps them make better decisions, and ultimately gets their products into the real world faster. It brings together the systems, data, intelligence, and applications hardware engineering requires to meet the AI moment. Hardware engineering teams use Nominal to simulate, test, manufacture, and operate the physical systems that keep the world moving, from spacecraft and autonomous vehicles to next-generation energy systems and robotics.\nOur customers span aerospace, defense, manufacturing, transportation, energy, and robotics. They include Anduril, Shield AI, Wisk Aero, Pratt Miller Motorsports, Antares, and Shinkei Systems, amongst others, alongside programs within the U.S. Air Force and Navy. Our team draws from SpaceX, Palantir, Anduril, Applied Intuition, Tesla, and other leading companies, united by a common mission: giving hardware engineers the tools to build the future with speed, safety, and confidence. We're a fast-moving team that owns problems end-to-end, works across disciplines, and thrives at the intersection of hardware and software.\nSome of the world’s leading technology investors, including Sequoia, Lightspeed, Founders Fund, General Catalyst, Lux Capital, and Insight Partners, are backing Nominal’s ambition to change how machines are built and operated. We’re looking for teammates who want to take on hard problems and help make a new generation of world-changing hardware possible.\nAbout the role\nOur customers, including programs within the U.S. Air Force and Navy, trust us with the data and controls behind their hardware, so our compliance posture has to hold up under outside scrutiny. Nominal's programs span FedRAMP, SOC 2, CMMC, and Cyber Essentials Plus (CE+), each with its own controls, evidence, and assessors. GRC is the function that keeps all of them moving and gets them across the line.\nWe're looking for a GRC Lead to own execution across every program. You'll hold a single view of where each framework stands, run the gap analysis and control uplift planning, and decide what gets fixed, in what order, and by whom. You'll also own the evidence tracker, drive task owners to closure, coordinate audit readiness and assessor logistics, and report compliance status to leadership. You are the execution owner, not a coordinator. Because the role takes program-management load off every technical lane, you'll have visible escalation authority from day one.\nThis is a high-ownership role for a GRC practitioner who has taken programs through real audits and knows that they pass when someone owns closure on every control, not when the tracker looks tidy. You'll shape which compliance problems we solve first and set the standard for how Nominal runs them.\nWhat you'll do\nOwn a single view across FedRAMP, SOC 2, CMMC, and CE+, so leadership and every technical team know where each program stands and what is blocking it.\nRun gap analysis and control uplift planning across frameworks, finding where one control satisfies several programs and where a new one is needed.\nSequence remediation across engineering, IT, and security, deciding what gets fixed when and by whom, and escalate when owners miss commitments.\nOwn the evidence tracker and drive task owners to closure ahead of every audit window.\nCoordinate audit readiness and assessor logistics for each program, from scoping and walkthroughs through findings response.\nReport compliance status to leadership with clear risks, owners, and dates.\nDefine how the programs run day to day, so task owners know what is expected and no program depends on one person.\nWe're looking for someone with\nHands-on experience running compliance programs through audits, such as FedRAMP, SOC 2, CMMC, or CE+.\nWorking knowledge of control frameworks and how they map to each other, such as NIST 800-53, NIST 800-171, and the SOC 2 trust services criteria.\nExperience turning gap analysis into a sequenced remediation plan with named owners and dates.\nA track record of owning evidence collection and audit readiness, including working directly with assessors.\nEnough technical fluency to talk with engineering, IT, and security teams about what a control means in practice and whether the evidence satisfies it.\nClear written and verbal communication when reporting status and risk to senior leaders.\nThe judgment to make calls amid competing priorities and to use escalation authority directly and calmly when owners miss commitments.\nSkills that supercharge us\nExperience building a GRC function at a growth-stage software company, from first tracker to repeatable process.\nHands-on use of compliance automation or GRC tooling, such as Drata, Vanta, or similar platforms.\nFamiliarity with handling CUI and export-controlled data across cloud, on-prem, and air-gapped environments.\nBackground at a defense contractor or a software company selling to federal customers.\nBenefits/Perks\n 100% coverage of medical, dental, and vision insurance\n Unlimited PTO and sick leave\n Free lunch, snacks, and coffee\n Professional Development Stipend\n In-office hardware lab with a $250 project stipend\n Annual company retreat\n 12 weeks parental leave\n Fertility and family planning ($15,000 lifetime)\n Wellness stipend ($100/month)\n $500/year hardware sensor stipend\n 401(k)\n Employee-friendly equity terms\n In-office 5 days per week\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, or national origin.\nITAR Requirements\nTo conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.\nCompensation\nThe base pay range for this role is $208,000 - $245,000 per year.","description_format":"text","description_chars":6225,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Equity","Parental leave","Professional development","Unlimited PTO","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Manufacturing & Industrial Software"],"lifecycle":[{"event":"open","at":"2026-11-08T23:16:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":57,"reasons":["conf:3","win:early"],"computed_at":"2026-11-09T02:25:04Z"},"pay":{"stated_usd_annual":245000,"is_top_pay":true},"html_url":"https://alion.io/job/nominal-grc-lead","json_url":"https://alion.io/job/nominal-grc-lead.json","meta":{"generated_at":"2026-11-09T02:25:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5080,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":63575},"rest":"https://alion.io/mcp/rest/get_company?id=63575"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnominal-grc-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnominal-grc-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnominal-grc-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nominal-grc-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnominal-grc-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3948116}},{"tool":"search_jobs","arguments":{"company":"nominal.io","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3948116},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}