Security Engineer

Security & Compliance Engineer

Join to apply for the Security & Compliance Engineer role at Nominal.

Nominal is building the software infrastructure powering the world’s most advanced hardware systems—from spacecraft and autonomous vehicles to next‑generation industrial machines. Our platform ingests high‑rate telemetry, validates complex autonomy software in real time, and enables engineers to iterate faster without sacrificing safety or precision. We’re a small, fast‑moving team of engineers and operators who own problems end‑to‑end, work across disciplines, and thrive on challenges at the intersection of hardware and software.

As an early team hire dedicated to information security (Security) and governance, risk, and compliance (GRC), you’ll be responsible for working across the organization, developing and maturing various Security and GRC controls. You’ll also play a critical role in assisting Nominal to meet various authority to operate (ATO) initiatives. This may include tasks such as hardening Nominal’s software platform (both security and availability), deploying into secure environments, assisting with incident response, managing Nominal’s network, ensuring endpoint security, establishing baseline device configuration, guaranteeing technical compliance with information security standards, and more.

• Own the Posture:
  Technical excellence in product hardening and information security is table‑stakes for Nominal’s success due to our product and industry. You’ll need to internalize this and fully own it in a first‑class way. Set Nominal up for success in serving large DoD and enterprise customers in a secure manner.
• Detect and Respond:
  Strengthen Nominal’s operational and product security through active monitoring, threat detection, and incident response. Manage endpoint protection and logging tools (e.g., EDR, SIEM), investigate alerts, and collaborate with engineering to close gaps and prevent recurrences.
• Plan and Execute:
  Translate GRC requirements (e.g., CMMC, NIST 800‑171, FedRAMP, NIST 800‑53, Impact Level (IL) 4/5, and National Security Systems (NSS)) to propose and lead a rollout of technical actions and policies that meet stringent information security standards. Assist and support the maintenance of our Information Security Program. Apply technology standards to classified, air‑gapped environments.
• Coach Our Team:
  Create and deliver approachable, relevant training to ensure all employees are equipped to maintain high technical standards for Security and Compliance. Provide guidance regarding procurement or download of secure, vetted third‑party software, applications, and libraries.
• Communicate the Standard:
  Prepare communications for government partners, assessors, auditors, and customers that satisfactorily explain Nominal’s technical security posture, both for our software platform and IT systems/endpoints, and inspire confidence in our secure product and business practices.

• 4+ years of experience working as a Security Engineer/Security Analyst.
• Hands‑on expertise in endpoint protection, event monitoring and logging (EDR & SIEM). Incident handling experience including incident preparation, detection, analysis, containment & eradication, and post‑mortem.
• Strong understanding of system administration, including network setup (VPN, SSIDs, firewalls), software & hardware allow listing/block listing, encryption & secure protocols, identity and access management controls.
• Familiarity with cloud environments such as AWS Gov Cloud, Microsoft Azure, Microsoft Government Community Cloud (GCC). Experience implementing and maintaining compliance frameworks such as CMMC, NIST 800‑171, FedRAMP, NIST 800‑53, DoD Impact Levels (IL4/5), National Security Systems (NSS), SOC2, and ISO 27001/27002.
• Experience with federal contracting and data protection requirements, whether in government or industry settings.
• Experience conducting risk assessments, vulnerability management, and security control testing to proactively identify and remediate issues and areas of improvement.
• General knowledge of Dev Sec Ops  and infrastructure concepts, with the…