The posting
Xona is the navigational intelligence company bringing real-time, centimeter-level certainty to any device, anywhere on Earth.
With Pulsar – the world’s most advanced PNT satellite infrastructure in Low Earth Orbit – Xona will offer a future-proof, backwards-compatible global positioning system optimized for absolute precision, superior power, and robust protection.
Xona Space is seeking a Senior Cybersecurity Engineer to lead the development and implementation of our cybersecurity and compliance programs. This role will play a key part in strengthening our security infrastructure and preparing the company for CMMC certification.
Working across IT, engineering, operations, and company leadership, you will take a hands-on approach to assessing security risks, implementing technical solutions, and establishing scalable security practices. The ideal candidate brings strong technical expertise, experience in regulated environments, and the ability to balance security requirements with the needs of a growing organization.
WHAT YOU'LL BE DOING
- Lead cybersecurity strategy and implementation. Assess our security posture, identify risks and gaps, establish priorities, and develop a roadmap for strengthening security across corporate IT, engineering, and cloud environments.
- Drive CMMC Level 2 readiness. Lead implementation of NIST SP 800-171 security requirements, define assessment scope, maintain compliance documentation, coordinate assessments, and prepare the organization for certification.
- Strengthen technical security infrastructure. Design, implement, and maintain security controls across identity and access management, endpoint protection, network security, cloud environments, vulnerability management, and Microsoft GCC High.
- Manage security operations and risk. Establish security monitoring, incident response, vulnerability remediation, and ongoing compliance processes. Evaluate third-party providers and technologies to ensure appropriate protection of sensitive and regulated information.
- Partner across the organization. Work with engineering, IT, operations, legal, and company leadership to integrate security into business and technical decisions, support government compliance obligations, and communicate risks and recommendations.
REQUIREMENTS
- 7+ years of relevant cybersecurity experience, preferably in regulated or government-contracting environments.
- Demonstrated experience implementing NIST SP 800-171 controls and preparing organizations for CMMC Level 2 certification.
- Hands-on experience administering Microsoft GCC High or Azure Government environments, including Entra ID, Intune, Defender, and Purview.
- Strong technical expertise across identity security, endpoint protection, network and cloud security, vulnerability management, and incident response.
- Working knowledge of CUI safeguarding, DFARS requirements, and ITAR/EAR data protection.
- Ability to independently assess security environments, prioritize initiatives, and drive implementation.
- Strong communication and documentation skills, including experience working with assessors, technical teams, and leadership.
- Relevant technical degree or equivalent professional experience.
REQUIRED CERTIFICATIONS AND CLEARANCE
- CMMC Certified Professional (CCP) minimum; CMMC Certified Assessor (CCA) preferred.
- CISSP or equivalent senior security certification.
- Active Secret Clearance.
PREFERRED QUALIFICATIONS
- Aerospace, defense, or space industry experience.
- Experience supporting a completed CMMC Level 2 certification.
- CGRC, Microsoft security certifications (SC-100, SC-300, SC-200), or relevant GIAC certifications.
- Experience with security automation using PowerShell, Python, or Bash.
- Experience with FAR/DFARS, NISPOM, DCSA reviews, or Facility Security Officer (FSO) responsibilities.
- Facility Clearance (FCL) experience.
For U.S. Roles: To comply with U.S. Government space technology export regulations, applicant must be a U.S. citizen, lawful permanent resident of the United States (i.e. Green Card holder), or other protected individual as defined by 8 U.S.C. 1324b(a)(3).
For U.K. Roles: To comply with U.K. regulations, this role requires Baseline Personnel Security Standard (BPSS) checks, and successful candidates must be eligible to obtain UK Security Clearance (SC).
For Canada Roles: Successful candidates must obtain and hold a security clearance at the reliability status level, and pass security assessment for the Canadian Controlled Goods Program (CGP) and ITAR.
We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.
