Anduril Industries is a defense technology company with a mission to transform U.S. and allied military capabilities with advanced technology. By bringing the expertise, technology, and business model of the 21st century’s most innovative companies to the defense industry, Anduril is changing how military systems are designed, built and sold. Anduril’s family of systems is powered by Lattice OS, an AI-powered operating system that turns thousands of data streams into a realtime, 3D command and control center. As the world enters an era of strategic competition, Anduril is committed to bringing cutting-edge autonomy, AI, computer vision, sensor fusion, and networking technology to the military in months, not years.
ABOUT THE JOB
As a Senior Compliance Analyst, you will serve as a key leader and subject matter expert (SME) in safeguarding our global enterprise. Alongside the Cybersecurity Risk and Compliance Team, you will work on the strategy, implementation, and maintenance of a unified cybersecurity compliance framework. Operating at the intersection of security, engineering, and business operations, you will proactively manage risks, lead external audit readiness, and translate complex regulatory requirements into actionable, scalable controls. This role requires a highly collaborative professional who can seamlessly interface with diverse business units—ranging from Manufacturing and Supply Chain to Legal and Engineering—ensuring our security posture supports business growth while meeting stringent global standards.
WHAT YOU'LL DO
Compliance Strategy & Framework Management
- Lead and maintain the enterprise-wide unified cybersecurity framework, ensuring continuous alignment with industry-leading standards.
- Own the lifecycle of certifications and recertifications for critical frameworks, including but not limited to CMMC/NIST SP 800-171, ISO 27001, Cyber Essentials, and GDPR.
- Author and optimize high-quality Governance, Risk, and Compliance (GRC) documentation, including System Security Plans, POA&Ms, policies, and standard operating procedures.
- Drive compliance automation by identifying, implementing, and optimizing GRC tools to streamline compliance tracking and reduce manual auditing efforts.
Risk Management & Auditing
- Design and conduct comprehensive security risk assessments, vulnerability reviews, and internal audits to identify, evaluate, and mitigate risks across the global infrastructure.
- Facilitate external audits, acting as the primary point of contact for regulatory auditors and assessors, ensuring smooth processes and timely resolution of findings.
- Advise on M&A and supply chain security, assessing the risk posture of third-party vendors and newly acquired entities to ensure seamless compliance integration.
Cross-Functional Collaboration & Security Enablement
- Partner with Leadership to translate technical compliance findings into risk-based decisions aligned with the company’s risk appetite and strategic goals.
- Collaborate as a Trusted Advisor with cross-functional teams—including Engineering, IT, Legal, Manufacturing, and Supply Chain—to embed security controls into daily workflows and product development lifecycles.
- Champion a culture of security by designing and delivering high-impact compliance education, security enablement sessions, and cross-departmental awareness initiatives.
- Develop executive-ready metrics and dashboards that clearly communicate the enterprise’s compliance posture and risk profile to senior leadership.
REQUIRED QUALIFICATIONS
- Education: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- Experience: Five or more years of progressive experience in cybersecurity GRC within a complex, enterprise environment.
- Framework Expertise: Deep hands-on experience implementing and auditing frameworks such as CMMC, ISO 27001, NIST 800-53/171, and GDPR.
- Communication: Exceptional written and verbal communication skills, with a proven ability to translate complex technical concepts into business-friendly language.
- Work Authorization: Must be authorized to work in the United States.
- Must be eligible to obtain and maintain a US Secret Clearance.
PREFERRED QUALIFICATIONS
- Professional Certifications: Highly preferred: CISSP, CISA, CRISC, CISM, or equivalent compliance/security credentials.
- Advanced Degree: Master’s degree in Business Administration (MBA), Cybersecurity, or a related discipline.
- GRC Tooling: Experience implementing and managing enterprise GRC platforms.
- Industry Experience: Experience in highly regulated industries such as Aerospace, Defense, Advanced Manufacturing, or high-tech.
The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. Highly competitive equity grants are included in the majority of full time offers; and are considered part of Anduril's total compensation package. Additionally, Anduril offers top-tier benefits for full-time employees, including:
Benefits
At Anduril, we invest in our people. Our comprehensive, competitive benefits package (available at little to no cost to employees) ensures you’re supported in health, recovery, and whatever comes next. For more information, Explore Our Benefits.
Protecting Yourself from Recruitment Scams
Anduril is committed to maintaining the integrity of our Talent acquisition process and the security of our candidates. We've observed a rise in sophisticated phishing and fraudulent schemes where individuals impersonate Anduril representatives, luring job seekers with false interviews or job offers. These scammers often attempt to extract payment or sensitive personal information.
To ensure your safety and help you navigate your job search with confidence, please keep the following critical points in mind:
-
No Financial Requests: Anduril will never solicit payment or demand personal financial details (such as banking information, credit card numbers, or social security numbers) at any stage of our hiring process. Our legitimate recruitment is entirely free for candidates.
- Please always verify communications:
- Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an
@anduril.comaddress. - Via Agency Partner: If contacted by a recruiting agency for an Anduril role, their email will clearly identify their agency. If you suspect any suspicious activity, please verify the agency's authenticity by reaching out to contact@anduril.com.
- Direct from Anduril: If you receive an email from one of our recruiters, it will only come from an
-
Exercise Caution with Unsolicited Outreach: If you receive any communication that appears suspicious, contains grammatical errors, or makes unusual requests, do not engage. Always confirm the sender's email domain is @anduril.com before providing any personal information or clicking on links.
-
What to Do If You Suspect Fraud: Should you encounter any questionable or fraudulent outreach claiming to be from Anduril, please report it immediately to contact@anduril.com. Your proactive caution is invaluable in protecting your personal information and upholding the security and trustworthiness of our recruitment efforts.
Data Privacy
To view Anduril's candidate data privacy policy, please visit https://anduril.com/applicant-privacy-notice/.
By submitting your application, you consent to Anduril Industries using a third-party service provider to conduct pre-employment risk, integrity, and due diligence screening and assessing potential risks as part of your application process. This third-party service provider provides risk-intelligence services that may include analysis of sanctions and watchlists, adverse media, public-record information, and other lawful open-source or commercial data sources. This third-party service provider does not act as a consumer reporting agency. Use of this provider helps to ensure compliance with applicable laws and protect technology, intellectual property, and organizational security.