Security Compliance Engineer

Job Description Overview:
The ASUS Robotics & AI Center is seeking a Security Compliance Engineer to establish and maintain the security compliance program for our autonomous systems and the platform that supports them. This role brings the security work of our engineering teams in Boston and Taipei together into a coherent, documented, and auditable whole, from system security planning through certification readiness and ongoing assurance.
We are looking for a disciplined professional with a background in information security, risk management, and information assurance who can translate frameworks and regulatory requirements into practical controls and processes. The ideal candidate is organized, self-directed, and comfortable working closely with engineers, product leads, and external assessors.
Essential Duties and Responsibilities:
Develop and maintain the system security plan and related security compliance documentation for ARAIC products, infrastructure, and development processes, and keep them current as the systems evolve.
Map security controls to applicable frameworks and standards and identify gaps between documented controls and the implemented system.
Coordinate security efforts across engineering teams so that hardware, embedded, cloud, and application work fits within a single coherent security architecture.
Coordinate threat modeling, risk assessments, and control prioritization with engineering teams.
Own certification and audit readiness, including assessment packages, readiness declarations, evidence collection, and responses to assessor requests.
Build and maintain processes for producing standard operating procedures for information assurance and compliance activities.
Establish processes that keep security documentation aligned with the implemented system, including configuration and change management practices.
Partner with DevOps and engineering teams to build compliance controls, validation, and evidence generation into development and operational workflows, including secure software supply chain practices.
Provide security awareness guidance and training to engineering and business teams.
Knowledge and Skills:
Working knowledge of security and compliance frameworks such as the NIST Risk Management Framework, NIST SP 800-53 or SP 800-171, CMMC, or ISO 27001.
Experience with risk assessment methods and the development of security controls, policies, and procedures.
Experience managing secure communications, cryptographic material, or controlled information in a regulated environment.
Strong documentation and written communication skills, including the ability to produce audit-ready material and to explain security requirements to engineers and non-technical stakeholders.
Demonstrated organizational skill and follow-through in coordinating work across multiple teams and disciplines.
Familiarity with secure system design concepts such as hardware roots of trust, secure boot, certificate management, and configuration management is a plus.
Experience with requirements management or compliance tracking tools is a plus.
Familiarity with DevSecOps practices and CI/CD pipelines is a plus.
Relevant certifications such as CISSP, CISA, CISM, CRISC, or CompTIA Security+ are a plus.
Flexibility to attend virtual meetings with the Taiwan-based team at least three nights per week, and to travel to Taipei once per quarter for stays of approximately two to three weeks.
Ability to work confidently