{"id":1998938,"url":"https://alion.io/job/sunmed-security-engineer-governance-risk-compliance","title":"Security Engineer-Governance, Risk & Compliance","company":{"id":3162899,"name":"SunMed","domain":"myairlife.com","url":"https://alion.io/company/myairlife","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"ADP","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Grand Rapids, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":115000,"max":130000,"currency":"USD","period":"year","gross":null,"usd_annual":130000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"21 CFR Part 820","optional":false},{"name":"GDPR","optional":false},{"name":"ISO 13485","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"Smartsheet","optional":false}],"status":"live","first_seen_at":"2026-08-13T20:43:00Z","employer_posted_date":"2026-08-13","last_verified_at":"2026-10-28T05:29:10Z","board_verified":true,"closed_at":null,"days_open":75,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":75},"description":"COMPANY DESCRIPTION\nAt AirLife, we are dedicated to improving the quality of every breath. Excellence with Every Breath is not just a tag line, but the way we work and take care of our customers. With a mindset to evolve, innovate, and grow, we are a premier manufacturer of the highest-quality and market-leading breathing consumables. This growth philosophy has positioned us to increase our global footprint and business reach, impacting even more people around the world. Our expanding family of the most trusted brands offers a product portfolio that spans the continuum of care from first responder to home care, with safety, patient comfort, and clinical performance in mind. Collective expertise allows us to provide quality products and experiences to our patients, customers, and our people. Our values of Customer first, Differentiate with our People, Bias for Action, Continuous Improvement and Accountability define who we are and how we work. Join us!\nPOSITION SUMMARY\nThe Security Engineer - Governance, Risk & Compliance is responsible for establishing and maturing AirLife's information security risk management and compliance posture. This role evaluates, quantifies, and helps mitigate security risks across IT infrastructure and business systems, while ensuring AirLife's cybersecurity practices remain aligned to applicable regulatory frameworks, industry standards, and internal policies. Operating in a medical device manufacturing environment with FDA and ISO regulatory obligations and a PE ownership structure with specific cybersecurity reporting requirements, this role brings both technical security knowledge and a compliance mindset to a rapidly maturing IT security program. The Security Engineer - GRC plays a critical role in AirLife's ability to satisfy external auditors, insurance underwriters, and PE sponsor security benchmarking requirements.\nPOSITION QUALIFICATIONS\nKnowledge, Skills & Abilities:\nStrong working knowledge of security risk management frameworks and methodologies, including NIST CSF, NIST SP 800-30/37, ISO 27001, and CIS Controls.\nUnderstanding of regulatory compliance requirements relevant to medical device manufacturing, including FDA 21 CFR Part 820 / QMSR and ISO 13485, and their implications for IT General Controls (ITGC) and computer system validation.\nExperience with IT General Controls frameworks and audit support, including SOX-adjacent controls applicable to PE-backed manufacturing companies.\nKnowledge of data privacy regulations, including GDPR and applicable US state privacy laws, and their operational IT implications.\nExperience conducting risk assessments, gap analyses, and security control reviews; ability to document, prioritize, and track findings through to remediation.\nExperience developing and maintaining security policies, standards, procedures, and control evidence libraries.\nFamiliarity with vulnerability management programs, including scanning tooling, remediation tracking, and risk-based prioritization.\nExperience administering security awareness training programs, including phishing simulation and completion tracking (KnowBe4 experience preferred).\nAbility to work with MDR/MSSP providers to ensure managed detection capabilities align with AirLife's compliance posture (Arctic Wolf experience a plus).\nStrong written communication skills; ability to clearly document findings, prepare audit evidence packages, and present risk posture to non-technical audiences including executives and external auditors.\nProficiency with project and task management tools; Smartsheet experience preferred.\nIndustry-recognized GRC or cybersecurity certification(s) preferred (CISA, CRISC, CompTIA Security+, SSCP, or equivalent).\nLevel of Experience:\nMinimum 4-6 years of IT experience with 3+ years in a cybersecurity role with a GRC, compliance, or risk management focus. Experience in a regulated manufacturing, medical device, or life sciences environment strongly preferred.\nLevel of Education:\nBachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent experience. GRC-relevant certification(s) preferred.\nTravel:\nUp to 20% as required by the business.\nESSENTIAL DUTIES AND RESPONSIBILITIES\nDevelop, implement, and maintain AirLife's information security policies, standards, and procedures, ensuring they remain current, compliant with applicable frameworks, and operationally effective for the teams they govern.\nConduct and facilitate periodic security risk assessments and gap analyses across IT infrastructure, business applications, and operational technology, documenting findings, quantifying risk, and recommending prioritized remediation measures to IT leadership.\nOwn AirLife's security compliance posture across applicable frameworks (NIST CSF, CIS Controls, ISO 27001, GDPR), including control documentation, evidence collection, ongoing compliance monitoring, and management of compliance calendars.\nSupport IT General Controls (ITGC) compliance, including access control review coordination, change management process documentation, and preparation and management of audit evidence packages for internal and external auditors.\nPartner with QA/RA and Legal & Compliance to ensure IT security controls are appropriately aligned to AirLife's 21 CFR Part 820 / QMSR and ISO 13485 obligations, particularly as they relate to computer system validation and access control in regulated processes.\nOwn and administer AirLife's security awareness and compliance training program, including planning and coordinating KnowBe4 phishing simulation and training campaigns, tracking completion rates across departments, and reporting to IT leadership on compliance status.\nMaintain and improve AirLife's vulnerability management program, including scheduling assessments, tracking and prioritizing remediation, and reporting vulnerability posture and trends to IT leadership.\nSupport Frazier Partners' cybersecurity benchmarking and reporting requirements; coordinate with Lockton for cyber insurance assessment preparation and supply requested security metrics, documentation, and evidence as required.\nCollaborate with Arctic Wolf and other managed security service providers to ensure managed services are operating in alignment with AirLife's compliance posture, risk appetite, and applicable regulatory requirements.\nMaintain, test, and continuously improve the IT Cyber Incident Response Playbook; support the planning and facilitation of tabletop exercises; assist in incident response coordination and post-incident review when security events occur.\nServe as the IT security subject matter expert for IT-related internal and external audits: prepare evidence packages, coordinate audit interviews, manage finding responses, and own remediation tracking through closure (including all enterprise applications and segregation-of-duties findings).\nBuild and maintain a comprehensive GRC documentation library, including the risk register, control matrix, policy library, compliance calendar, and audit history, ensuring currency and accessibility for authorized stakeholders.\nOTHER RESPONSIBILITIES\nUphold and embody AirLife's values in all aspects of work.\nDemonstrate accuracy and thoroughness in daily work; look for ways to improve and promote quality & safety.\nInspire the trust of others; treat people with respect and dignity and embrace the value of diversity.\nUse time efficiently; perform job accurately, thoroughly, and conserve Company resources to improve profits.\nContribute to building and maintaining a positive team environment.\nAssure all policies and guidelines are implemented and followed.\nQUALITY POLICY\nAt AirLife, Quality is our promise. It is our commitment to customer satisfaction and our dedication to product excellence in an evolving global healthcare market. This promise is kept through a continuously improving and effective Quality Management System and compliance to Regulatory Requirements.\nDEIA STATEMENT\nAt AirLife, we are committed to building a diverse workforce and an inclusive workplace that reflects the communities and customers we serve. We believe our philosophy on Diversity, Equity, Inclusion, and Advancement (DEIA) encourages excellence and equips us to serve an evolving global marketplace.\nPlease note: The responsibilities outlined above are not exhaustive and may evolve over time. The role holder may be required to undertake additional duties as reasonably expected to meet the needs of the company.\nBenefits\nAirLife offers a comprehensive benefits package, including medical, dental, and vision coverage, 401(k), paid time off, paid holidays, bereavement leave, Employee Assistance Program resources, and medical leave benefits, subject to applicable eligibility requirements. Certain positions may also be eligible for bonus, commission, or other incentive compensation.","description_format":"text","description_chars":8881,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Health Care","Information Security","Health & Medical Electronics","Medical AI"],"lifecycle":[{"event":"open","at":"2026-10-07T10:19:30Z"}],"visa":[],"liveness":{"score":13,"band":"cold","label":"Long shot","p_open":1,"p_active":0.458,"p_room":0.28,"age_days":75,"expected_fill_days":30,"reasons":["conf:0","win:tail","crowd:"],"computed_at":"2026-10-28T05:59:10Z"},"pay":{"stated_usd_annual":130000,"is_top_pay":true},"html_url":"https://alion.io/job/sunmed-security-engineer-governance-risk-compliance","json_url":"https://alion.io/job/sunmed-security-engineer-governance-risk-compliance.json","meta":{"generated_at":"2026-10-28T06:11:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8069,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3162899},"rest":"https://alion.io/mcp/rest/get_company?id=3162899"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsunmed-security-engineer-governance-risk-compliance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsunmed-security-engineer-governance-risk-compliance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsunmed-security-engineer-governance-risk-compliance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sunmed-security-engineer-governance-risk-compliance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsunmed-security-engineer-governance-risk-compliance"}]}