Skip to content
The board
JobStartup
FinanceEngineering

Governance, Risk & Compliance (GRC) Analyst

CHAOS Industries · Engineering

View original
Where
Washington D.C.
Posted
Sep 10

CHAOS Industries is redefining modern defense with a multi-product portfolio that gives the ultimate advantage—domain dominance. The company's products are powered by Coherent Distributed Networks (CDN™), empowering warfighters, commercial air operators, and border protection teams to act faster, adapt rapidly, and stay ahead of evolving threats.

CHAOS Industries was founded in 2022 and has raised a total of $1 billion in funding from leading investors, including 8VC, Accel, and Valor Equity Partners. The company is headquartered in Los Angeles, with offices in Washington, D.C., San Francisco, San Diego, Seattle, and London. For more information, please visit www.chaosinc.com.

Role Overview:

What you'd do

  • Own risk assessments across several departments and maintain the centralized risk register.
  • Design and maintain a unified, original control framework tailored to CHAOS Industries' operating environment, including a security-by-design approach to systems development and defined: Maximum Tolerable Downtime (MTD), Recovery Point Objective (RPO), and Recovery Time Objective (RTO) for critical systems.
  • Write and maintain policy that goes beyond minimum mandatory compliance, building genuine security maturity rather than satisfying the floor of any one requirement.
  • Manage GRC tooling and related workflows to support risk assessments, control monitoring, and reporting.
  • Prepare for, coordinate, and help run third-party and certification audits, including evidence collection, gap assessments, and auditor liaison.
  • Act as the connective tissue between different department to then develop security and compliance requirements for partner teams and drive them to execution.
  • Report regularly to the Program Director and executive stakeholders on risk posture, audit status, and program maturity.
  • Onsite presence required 4 days per week.
  • Travel: up to 25%, primarily to support Manufacturing and Physical Security control validation across company sites.
  • Physical demands: occasional access to manufacturing floor environments, including required PPE and periods of standing or walking during facility walkthroughs.

What they want

  • Bachelor’s degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field, or equivalent practical experience.
  • Deep knowledge of NIST CSF, NIST RMF, the ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53.
  • Experience selecting, implementing, or administering GRC tooling and workflows.
  • Exposure to widely recognized governance, risk, and compliance frameworks spanning security, privacy, and quality management domains.
  • Familiarity with OT/ICS security concepts.
  • Minimum of 5 years hands-on GRC or compliance experience combined with prior experience in a DoD environment or military service.
  • Has directly supported a third-party or certification audit from evidence collection through closure.
  • Can apply recognized governance, risk, and compliance frameworks well enough to design real, working controls tailored to a specific organization, not just describe them generically.
  • Has performed or directly supported a formal risk assessment (identification, scoring, and treatment) using a defined methodology.