GRC Security Architect

At Stoke, we believe a thriving space economy will enable a vibrant, sustainable, and equitable future here on Earth. That is why we’re building Nova, our fully and rapidly reusable launch vehicle. Designed for daily flight, Nova tackles the core challenges of space transportation by reducing cost, increasing availability, and improving reliability. By radically lowering launch costs and increasing flight cadence, we’re helping create a truly scalable space industry.

Our team is mission‑driven, collaborative, and empowered to take ownership of their work. If you want to work alongside some of the most dedicated and talented people on Earth, we’d love to have you join us.

Reusable launch systems depend on security, compliance, and risk management that enable speed without compromising the mission. As a GRC Security Architect, you will own the security governance, risk, and compliance architecture for Stoke’s NOVA program as we build and scale a fully reusable launch vehicle.

This is a hands‑on role with end‑to‑end ownership of how security requirements become practical, auditable, and scalable controls across the company. You will define and drive the policies, standards, control implementations, risk processes, and evidence systems that support frameworks such as NIST 800-171, NIST 800-53, CMMC, DFARS, CUI, ITAR, and other customer or regulatory requirements. You will work directly with SMEs across IT, security, software, infrastructure, engineering, manufacturing, legal, finance, and operations to translate complex obligations into controls that are clear, effective, and realistic for a fast‑moving rocket company.

You own the outcome, not just the checklist.

We are a small, highly motivated team. You will work shoulder‑to‑shoulder with engineers, system owners, business leaders, and operations teams to identify risk, design practical mitigations, prepare for audits and assessments, and build a security program that enables the company to move fast while protecting sensitive information and mission‑critical systems.

You must be ready to stay focused, move quickly, self‑direct, and learn on the fly.

• Lead the design, implementation, and continuous improvement of the company’s governance, risk, and compliance program for our NOVA program
• Architect security and compliance controls that support a regulated aerospace environment, including systems that may process or support CUI, ITAR‑controlled data, export‑controlled information, proprietary engineering data, and other sensitive business information
• Own and mature the company’s risk management process, including risk identification, assessment, treatment planning, exception handling, control validation, and executive‑level risk reporting
• Define, document, and maintain security policies, standards, procedures, control narratives, and implementation guidance aligned with frameworks such as NIST SP 800‑171, NIST SP 800‑53, CMMC, SOC 2, ISO 27001, DFARS, FedRAMP‑informed cloud security practices, and other applicable requirements
• Translate regulatory and contractual security requirements into practical, scalable technical and operational controls that can be implemented by IT, Engineering, Manufacturing, Software, Legal, Finance, and business teams
• Partner with IT and software engineering teams to design security controls that are effective, auditable, and compatible with fast‑moving technical operations
• Develop and maintain key compliance artifacts, including control mappings, system security plans, control implementation statements, risk registers, POA&Ms, evidence repositories, audit responses, and executive summaries
• Lead internal readiness activities for audits, assessments, customer security reviews, and third‑party compliance engagements
• Evaluate proposed systems, tools, vendors, cloud services, and business processes for security, compliance, data protection, and regulatory risk
• Provide security architecture guidance for sensitive systems, including identity and access management, logging and monitoring, endpoint protection, vulnerability management, network segmentation, secure cloud design, data handling, and secure software…