Senior Compliance Engineer, AI Governance

<div class="content-intro"><p class="ms-outlook-mobile-reference-message">Space is a warfighting domain. True Anomaly seeks those with the talent and ambition to build the technology that secures it.</p>
<p class="ms-outlook-mobile-reference-message"><u>OUR MISSION</u></p>
<p class="ms-outlook-mobile-reference-message">True Anomaly delivers decisive capabilities for space superiority. We build autonomous spacecraft, advanced payloads, mission software, and space-based interceptors — enabling the U.S. and its Allies to secure the space environment and counter threats from the ultimate high ground.</p>
<p class="ms-outlook-mobile-reference-message"><u>OUR VALUES</u></p>
<ul>
<li class="ms-outlook-mobile-reference-message"><strong>Be the offset.</strong><span class="Apple-converted-space"> </span>We create asymmetric advantages with creativity and ingenuity.</li>
<li class="ms-outlook-mobile-reference-message"><strong>What would it take?</strong> We challenge assumptions to deliver ambitious results.</li>
<li class="ms-outlook-mobile-reference-message"><strong>It’s the people.</strong> Our team is our competitive advantage and we are better together.</li>
</ul></div><p><strong><span data-contrast="auto">Your Mission</span></strong><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<p><span data-contrast="auto">We are seeking a rare combination of disciplines: an experienced Sr. Compliance Engineer with deep AI Subject Matter Expertise (SME) and export compliance background to join our Governance, Risk, and Compliance (GRC) team. This role is responsible for building, implementing, and sustaining the organizational compliance posture across key regulatory and security frameworks — with a primary emphasis on RMF (NIST 800-53 Rev. 5 + Classified Overlays), CMMC Level 3, NIST 800-171 Rev. 3, EAR/ITAR cyber regulations, and — critically - the governance, risk management, and compliance controls surrounding AI/ML systems and large language models (LLMs) deployed across the enterprise.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<p><span data-contrast="auto">As AI becomes embedded in True Anomaly's operations, mission systems, and products, this role serves as the organizational authority on how AI capabilities are adopted, audited, and controlled responsibly. You will architect and operationalize compliance checkpoints and governance gates within LLM pipelines, evaluate AI vendors and platforms (including OpenAI, Anthropic Claude, and others) against classified and unclassified compliance requirements, and ensure AI-driven workflows satisfy both regulatory obligations and internal risk tolerance.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<p><span data-contrast="auto">The ideal candidate brings deep GRC knowledge, hands-on AI/LLM engineering fluency, and the ability to engage credibly with compliance assessors, government partners, and internal AI/ML engineering teams alike.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<p><span data-ccp-props="{"201341983":0,"335559739":0,"335559740":240}"> </span></p>
<p><strong><span data-contrast="auto">Responsibilities</span></strong><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<p> </p>
<p><strong><span data-contrast="auto">Compliance Program Execution</span></strong><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="auto">Lead and support compliance assessment readiness across key organizational frameworks including NIST SP 800-171 Rev. 2 and 3, CMMC Level 3, NIST SP 800-53 Rev. 5, and the NIST Cybersecurity Framework (CSF).</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="auto">Provide direction on cybersecurity readiness to address EAR and ITAR-related controls and requirements.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1"><span data-contrast="auto">Drive CMMC readiness activities across the organization, including scoping, gap analysis, control implementation validation, evidence collection, and pre-assessment preparation.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="auto">Review, maintain, and mature System Security Plans (SSPs) to accurately reflect organizational control implementations, system boundaries, and operational practices — including AI/ML system boundaries and data flows.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1"><span data-contrast="auto">Manage Plans of Actions and Milestones (POA&Ms), tracking open findings to resolution, communicating status to GRC leadership, and coordinating remediation efforts across responsible teams.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="6" data-aria-level="1"><span data-contrast="auto">Conduct internal compliance audits and control effectiveness reviews to ensure ongoing adherence to applicable frameworks and to surface emerging gaps before external assessments.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="7" data-aria-level="1"><span data-contrast="auto">Maintain audit-ready evidence repositories and documentation packages, ensuring traceability between controls, evidence, and framework requirements.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<p> </p>
<p><strong><span data-contrast="auto">AI Governance, Risk & Compliance (AI-GRC)</span></strong><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="auto">Serve as the organizational AI compliance SME — the primary authority on how AI/LLM systems (including OpenAI GPT models, Anthropic Claude, open-source models, and internally developed models) are evaluated, onboarded, and continuously governed within True Anomaly's compliance boundaries.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="auto">Design, implement, and maintain compliance checkpoints and enforcement gates within LLM pipelines, including: </span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="o" data-font="Courier New" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":1440,"335559991":360,"469769226":"Courier New","469769242":[9675],"469777803":"left","469777804":"o","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="2"><span data-contrast="auto">Input/output filtering and content policy enforcement layers</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="o" data-font="Courier New" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":1440,"335559991":360,"469769226":"Courier New","469769242":[9675],"469777803":"left","469777804":"o","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="2"><span data-contrast="auto">Prompt injection detection and mitigation controls</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="o" data-font="Courier New" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":1440,"335559991":360,"469769226":"Courier New","469769242":[9675],"469777803":"left","469777804":"o","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="2"><span data-contrast="auto">Data classification guardrails to prevent CUI, ITAR-controlled, or classified data from flowing into non-authorized AI systems or endpoints</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="o" data-font="Courier New" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":1440,"335559991":360,"469769226":"Courier New","469769242":[9675],"469777803":"left","469777804":"o","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="2"><span data-contrast="auto">Automated audit logging of AI interactions for traceability and incident investigation</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="o" data-font="Courier New" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":1440,"335559991":360,"469769226":"Courier New","469769242":[9675],"469777803":"left","469777804":"o","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="2"><span data-contrast="auto">Model access control and role-based permissions within AI platforms</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1"><span data-contrast="auto">Conduct AI-specific risk assessments, including evaluation of AI vendor data handling practices, model training data provenance, and third-party AI API security postures against NIST AI RMF, NIST SP 800-53 AI overlays, and internal standards.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="auto">Develop and enforce an AI System Acceptable Use Policy and supporting standards that govern how employees and systems interact with LLMs, including permissible data inputs, output handling, human-in-the-loop requirements, and escalation procedures.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1"><span data-contrast="auto">Evaluate proposed AI/ML use cases for regulatory risk (EAR/ITAR, CMMC, data privacy) and provide compliance go/no-go determinations with documented rationale.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="6" data-aria-level="1"><span data-contrast="auto">Collaborate with AI/ML engineers and DevSecOps teams to integrate compliance gates into CI/CD pipelines and MLOps workflows, ensuring model changes and prompt changes undergo review before production deployment.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="7" data-aria-level="1"><span data-contrast="auto">Maintain an AI system inventory, tracking all deployed models, APIs, integrations, and associated risk and compliance status.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="8" data-aria-level="1"><span data-contrast="auto">Monitor emerging AI regulatory developments (e.g., EO 14110, NIST AI RMF, DoD AI Ethics Principles, EU AI Act implications for U.S. defense partners) and assess organizational impact.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<p> </p>
<p><strong><span data-contrast="auto">Cross-Functional Compliance Enablement</span></strong><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></p>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="auto">Serve as a primary GRC team resource for compliance questions, control guidance, and framework interpretation across engineering, IT, operations, legal, and security teams.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="auto">Partner with IT and security operations teams to verify that technical controls — including access management, logging, configuration baselines, and incident response procedures — meet CMMC and NIST requirements at an organizational level.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1"><span data-contrast="auto">Partner with AI/ML engineers, data scientists, and product teams to embed compliance thinking into AI system design, model selection, and deployment architecture.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="auto">Collaborate with the Enterprise Risk Manager and broader GRC leadership to ensure compliance findings — including AI-specific risks — are reflected in the enterprise risk register and remediation priorities.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1"><span data-contrast="auto">Support the development of compliance training and awareness materials, including AI-specific training that builds organizational understanding of responsible AI use, LLM risk, and CMMC obligations.</span><span data-ccp-props="{"134233117":true,"134233118":true,"201341983":0,"335559740":240}"> </span></li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol&q