Regulatory Compliance Counsel

About the Role

Hermeus is hiring a regulatory compliance attorney to build and run its export control and trade compliance program. You will be the go-to advisor on ITAR, EAR, and related trade controls, own jurisdiction and classification work, and prepare export authorizations.

This role sits on-site alongside the engineering teams, and that placement is deliberate. You will learn Hermeus' hardware, software, and technical data well enough to make sound classification and marking calls quickly. You will also shape compliance into engineering workflows from the start.

This is a hands-on builder role. You will write the policies, train the workforce, make the classification calls, and file the licenses. You will also find ways to use AI tools to speed up the work and give employees self-service answers to routine compliance questions.

Depending on your background, the role can also cover advising on CUI, proprietary and technical data protection, Department of War contracting and security requirements, FCPA, anti-bribery and corruption, ethics, and FAA and FCC regulatory matters. In addition, the role may support direct and indirect supplier and consultant agreements and intellectual property matters.

Responsibilities

Work alongside stakeholders

• Coordinate closely with engineering, supply chain, and business development teams and build close working relationships so compliance questions come to you early, while design choices are still open.
• Turn compliance requirements into simple steps built into engineering tools and processes, such as PLM, document control, and data repositories.
• Work alongside leadership reviewing presentation materials and reviewing corporate transactions for trade compliance concerns and related regulatory matters (e.g. CFIUS).

Build and run the trade compliance program

• Design, document, and roll out an export compliance program scaled to a fast-growing hardware company. This includes policies, procedures, a technology control plan, recordkeeping, and internal audit protocols.
• Keep DDTC registration current and support Empowered Official functions. Track and manage all export authorizations, including scope, provisos, and expiration dates.
• Set up restricted party screening, foreign person access controls, deemed export reviews, and visitor and foreign travel processes.
• Track changes to ITAR, EAR, OFAC sanctions, and import rules. Translate them into practical guidance and process updates.
• Run internal assessments, investigate potential violations, carry out corrective actions when needed.
• Choose, configure, and manage compliance tools (screening, classification databases, and license tracking) with IT and operations.

Jurisdiction and classification

• Make and document jurisdiction and classification determinations for Hermeus's hardware, software, technical data, and defense services. This covers USML categories, the order of review for specially designed items, ECCNs, and EAR99.
• Prepare commodity jurisdiction (CJ) and commodity classification (CCATS) requests when a formal determination serves the business.
• Work closely with engineering and supply chain to review supplier and OEM classifications. Maintain a classification matrix for Hermeus's bill of materials and technical data, and keep it current as designs and suppliers change.

Licensing and authorizations

• Draft and submit DSP-5, DSP-73, and other DDTC license applications, plus technical assistance agreements (TAAs) and manufacturing license agreements (MLAs). Draft BIS license applications.
• Determine whether ITAR exemptions or EAR license exceptions apply, and document their use, recordkeeping, and reporting.
• Support international business development, allied engagement, foreign supplier relationships, trade shows, and test campaigns with licensing strategy and timelines.
• Act as a working point of contact with DDTC, BIS, DTSA, and Department of War program offices on licensing matters.

Document markings and technical data controls

• Set marking standards for export-controlled technical data, CUI, proprietary information, and government data rights legends.
• Advise company leadership on corporate transactions and fundraising materials.
• Advise engineers and program teams on marking drawings, models, software, presentations, proposals, and deliverables; train people on how to conduct such classifications and markings themselves.
• Review technical data transfers to foreign persons and third parties.
• Approve information before public release, publication, or conference presentation.
• Work with IT and security on access controls, export-compliant cloud environments, and data handling requirements.

AI-enabled compliance and employee self-service

• Find where AI tools can speed up compliance work, such as classification research, license drafting, marking reviews, regulatory monitoring, and screening triage.
• Build, configure, and train AI tools, including prompts, playbooks, curated knowledge bases, and workflows, using Hermeus policies, prior determinations, and approved guidance.
• Design self-service tools for employees, such as marking guidance, foreign person interaction checks, and routine export questions. Set clear rules for when a question goes to a lawyer.
• Set guardrails for AI use on controlled information. Make sure tools and data environments meet export control and CUI handling requirements.

Additional regulatory areas (based on experience)

• Department of War: Foreign Review DFARS and FAR clauses with compliance obligations, including data rights, cybersecurity, and supply chain restrictions. Support facility and personnel security requirements, and work with contracts counsel on OTAs and other contracting vehicles. Enable foreign military sales and direct commercial sales for defense products and services.
• FAA: Advise on test-related regulatory matters, including airworthiness certificates, airspace authorizations and waivers, and coordination with test range authorities.
• FCC: Advise on spectrum use for testing and operations, including experimental radio licenses, equipment authorization, and coordination with federal spectrum users.
• Import compliance: Advise on HTS classification, country of origin, and customs broker oversight as Hermeus' supply chain grows.
• Supply Chain: Advise on flowing down CUI, export control, and data protection obligations to subcontractors and suppliers. Advise on supplier screening requirements and engage in selection decisions.
• IP: Support protection of Hermeus trade secrets and proprietary technical data in NDAs, teaming agreements, and supplier agreements.

Requirements

• J.D. and active membership in good standing in at least one U.S. state bar. California bar admission or Registered In-House Counsel status.
• 4 or more years of experience with ITAR and EAR, gained at a law firm, in-house at an aerospace or defense company, or in government.
• Hands-on experience with jurisdiction and classification analysis, including drafting CJ or CCATS requests.
• Experience drafting DDTC license applications and agreements (TAAs or MLAs) and BIS license applications.
• Experience with OFAC sanctions and import or customs compliance.
• Working knowledge of technical data controls, deemed exports, restricted party screening, and voluntary disclosures.
• Ability to read engineering drawings and technical specifications well enough to analyze and classify them, and to work credibly and daily with engineers.
• Clear, practical writing and training skills for technical and non-legal audiences.
• Willingness to work on-site in the Los Angeles area full time.
• This position requires an active or current (eligible for reinstatement) security clearance at time of hire. A clearance is considered current if it has been inactive for less than 24 months and is eligible for reinstatement. U.S. citizenship is required for clearance eligibility.

Preferred Skills and Experience

• Prior experience at a startup or high-growth company, ideally in defense technology or aerospace, including building a compliance program or function from scratch.
• Hands-on experience building, configuring, or training AI tools to improve legal or compliance work, or to give employees self-service answers.
• Experience with allied defense cooperation frameworks or foreign military sales support.
• Industry certification such as SIA, ICPA, SCCE.
• 8-10 years of legal and/or compliance practice.
• Active security clearance, or ability to obtain and maintain one.
• Experience with CUI programs, NIST SP 800-171, CMMC, or DFARS cybersecurity requirements.
• Experience with FAA, FCC, or Department of War regulatory matters.

Pay and benefits

The salary range listed for this role is intended as a general guideline. Final compensation will be determined based on a variety of factors, including role scope and responsibilities, relevant experience, education and training, key skills, market data, and business needs.

At Hermeus, compensation is only one part of our total rewards package. We offer competitive pay, equity, and a range of benefits designed to support our team.

Benefits

• Health & Wellness: 100% employer-paid healthcare and pet insurance
• Financial: Competitive pay, stock options, 401(k) retirement plan, and potential year-end bonuses
• Time Off: Paid parental leave, 12 federal holidays, unlimited PTO for exempt employees, and generous accrued PTO for non-exempt employees

Office Perks

Weekly paid office lunches and fully stocked breakrooms

U.s. Export Control Compliance Status

The person hired will have access to information and items subject to U.S. export controls, and therefore, must either be a “U.S. person” as defined by 22 C.F.R. § 120.62 or otherwise eligible for deemed export licensing. US persons include U.S. citizens, U.S. nationals, lawful permanent residents (green card holders), and asylees and refugees with such status granted, not pending.