SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars.

SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next.

SR. SECURITY ANALYST, THIRD PARTY RISK MANAGEMENT

We are seeking a mid-to-senior Governance, Risk, and Compliance (GRC) professional focused on third-party risk management (TPRM) to own and scale our vendor risk program as SpaceXSI grows. This role sits at the intersection of cybersecurity GRC, vendor management, and procurement: you will assess the full range of third parties the company depends on — software and SaaS providers, cloud and infrastructure partners, AI model and data providers, professional services firms, and other suppliers — from intake and due diligence through ongoing monitoring and offboarding. The ideal candidate brings a cybersecurity and GRC perspective — fluent in how cloud services, identity and access management, encryption, data flows, and AI/LLM systems actually work in production — and can translate assessment findings into clear, risk-based decisions on residual risk and compensating controls rather than simply documenting issues. You will collaborate across procurement, legal, security, privacy, engineering, and business owners to keep third-party risk clear, proportionate, and actionable across enterprise, commercial, and public-sector environments.

RESPONSIBILITIES

Own the end-to-end third-party risk lifecycle — intake, inherent risk tiering, due diligence, risk decisioning, contracting support, ongoing monitoring, and offboarding — for vendors and partners across the company
Design and maintain the risk-tiering methodology and inherent risk questionnaire based on data sensitivity, system and network access, business criticality, and regulatory exposure, so that assessment depth matches actual risk and lower-risk vendors move quickly
Conduct security, privacy, and business due diligence: issue and review security questionnaires (e.g., SIG, CAIQ, custom assessments), evaluate architecture diagrams and data flows, run follow-up sessions with vendor security teams, and coordinate business checks such as corporate registration, reputational review, and insurance coverage with cross-functional partners
Critically review independent assurance reports and security documentation, including SOC 1/SOC 2 Type II reports, ISO 27001 and ISO 42001 certificates and Statements of Applicability, penetration test and vulnerability summaries, and bridge letters. Evaluate scope, carve-outs, exceptions, and complementary user entity controls (CUECs) that SpaceXSI must operate
Translate findings into clear risk decisions: weigh residual risk and compensating controls, recommend approval, conditional approval, or rejection, and document risk exceptions and risk acceptances with clear rationale, owners, and expiration dates
Partner with Legal and Procurement to define and negotiate contract security terms, including security and data protection exhibits, DPAs, breach notification, right-to-audit, sub-processor clauses, and data retention and deletion requirements, and ensure SpaceXSI's compliance obligations flow down to vendors and sub-processors
Assess the risk of AI vendors and AI-enabled services, including model and data handling, training-data use and boundaries, prompt and output controls, data residency, and alignment with AI governance frameworks (e.g., NIST AI RMF, ISO 42001, EU AI Act)