Senior Cybersecurity Engineer

Xona Space Systems is seeking a Senior Cybersecurity Engineer to lead the build-out of cybersecurity and compliance programs across corporate IT, engineering, and cloud environments. Based in Burlingame, CA on an onsite basis, this role combines hands-on security risk assessment with technical security control implementation, with direct focus on CMMC Level 2 readiness.

You will help strengthen the organization’s security posture by evaluating current controls, identifying risks and gaps, and driving a roadmap that supports both day-to-day operations and government compliance obligations.

Key Responsibilities

• Lead cybersecurity strategy and implementation across the organization.
• Assess security posture, identify risks and gaps, establish priorities, and develop a roadmap to strengthen security across corporate IT, engineering, and cloud environments.
• Drive CMMC Level 2 readiness efforts.
• Lead implementation of NIST SP 800-171 security requirements, including defining assessment scope, maintaining compliance documentation, coordinating assessments, and supporting organizational preparation for certification.
• Design, implement, and maintain security controls across identity and access management, endpoint protection, network security, cloud environments, vulnerability management, and Microsoft GCC High.
• Manage security operations and risk through security monitoring, incident response, vulnerability remediation, and ongoing compliance processes.
• Evaluate third-party providers and technologies to ensure appropriate protection of sensitive and regulated information.
• Partner across engineering, IT, operations, legal, and company leadership to integrate security into business and technical decisions, support government compliance obligations, and communicate risks and recommendations.

Required Qualifications

• 7+ years of relevant cybersecurity experience, preferably in regulated or government-contracting environments.
• Demonstrated experience implementing NIST SP 800-171 controls and preparing organizations for CMMC Level 2 certification.
• Hands-on experience administering Microsoft GCC High or Azure Government environments, including Entra ID, Intune, Defender, and Purview.
• Strong technical expertise across identity security, endpoint protection, network and cloud security, vulnerability management, and incident response.
• Working knowledge of CUI safeguarding, DFARS requirements, and ITAR/EAR data protection.
• Ability to independently assess security environments, prioritize initiatives, and drive implementation.
• Strong communication and documentation skills, including experience working with assessors, technical teams, and leadership.
• Relevant technical degree or equivalent professional experience.

Technologies

• NIST SP 800-171, CMMC Level 2, Microsoft GCC High, Azure Government, Entra ID, Intune, Defender, Purview
• PowerShell, Python, Bash
• CUI, DFARS, ITAR/EAR
• CMMC Certified Professional (CCP), CMMC Certified Assessor (CCA)
• CISSP, SC-100, SC-300, SC-200
• GIAC, CGRC, FAR/DFARS, NISPOM, DCSA reviews, FSO, FCL

Required Certifications and Clearance

• CMMC Certified Professional (CCP) minimum; CMMC Certified Assessor (CCA) preferred.
• CISSP or equivalent senior security certification.
• Active Secret Clearance.

Preferred Qualifications

• Aerospace, defense, or space industry experience.
• Experience supporting a completed CMMC Level 2 certification.
• CGRC, Microsoft security certifications (SC-100, SC-300, SC-200), or relevant GIAC certifications.
• Experience with security automation using PowerShell, Python, or Bash.
• Experience with FAR/DFARS, NISPOM, DCSA reviews, or Facility Security Officer (FSO) responsibilities.
• Facility Clearance (FCL) experience.

Compensation

USD 180,000 - 210,000 per year.

U.S. Roles Eligibility

To comply with U.S. Government space technology export regulations, applicants must be a U.S. citizen, lawful permanent resident (Green Card holder), or other protected individual as defined by 8 U.S.C. 1324b(a)(3).

U.K. Roles Eligibility

To comply with U.K. regulations, this role requires Baseline Personnel Security Standard (BPSS) checks, and successful candidates must be eligible to obtain UK Security Clearance (SC).

Canada Roles Eligibility

Successful candidates must obtain and hold a security clearance at the reliability status level, and pass security assessment for the Canadian Controlled Goods Program (CGP) and ITAR.