Chief Information Security Officer (CISO)

Ursa Major•Longmont, CO

About The Position

Ursa Major is seeking an executive technology leader to serve as Chief Information Security Officer. Reporting to the executive leadership team, the CISO will establish enterprise-wide information security ownership across multi-site engineering, manufacturing, and test facilities. In close partnership with the Facility Security Officer (FSO), who leads personnel clearances, physical security, and NISPOM facility compliance, the CISO is the senior authority for digital, technical, and operational cybersecurity. The role calls for a hands-on builder with deep Aerospace and Defense experience who can develop, scale, and mature security systems. The CISO will own risk management for unclassified and classified programs, champion expansion of hybrid CMMC Level 2 enclaves, govern classified defense-enclave architecture, protect intellectual property, and establish cyber risk governance suited to a high-growth defense company preparing for public-company operations.

Requirements

12 or more years of progressive experience in cybersecurity, information assurance, and secure systems architecture.
At least 5 years in senior leadership or technical management roles within the Aerospace and Defense sector.
Active U.S. Government Top Secret security clearance; active or recent SCI/SAP eligibility is preferred.
Demonstrated success partnering with Facility Security Officers, government Authorizing Officials, and program leadership to secure facility authorizations and system ATOs.
Deep technical and regulatory mastery of NIST SP 800-171, CMMC Level 2, NIST SP 800-53, RMF, JSIG, and NISPOM.
Ability to lead hands-on technical initiatives, conduct architectural reviews with engineering teams, and communicate strategic risk and vision to executives and government customers.
Experience managing enterprise incident response, endpoint detection, identity federation, and Zero Trust micro-segmentation in hybrid IT/OT manufacturing environments.
Current CISSP, CISM, or equivalent executive-level security certification.

Nice To Haves

Active TS/SCI with current SAP/SAR access.
Experience leading an organization through a successful DCSA security inspection or C3PAO CMMC Level 2 assessment.
Practical familiarity with public-company readiness, including SOX compliance, cyber risk disclosures, and enterprise business continuity planning.
Master’s degree in Cybersecurity, Computer Science, Information Assurance, or a related field.

Responsibilities

Define and execute enterprise cybersecurity and information assurance strategy across corporate, manufacturing, engineering, and classified program environments.
Build, mentor, and inspire a cybersecurity engineering and compliance team, promoting operational enablement, technical rigor, and cross-functional partnership.
Advance and accredit CMMC Level 2 / NIST SP 800-171 architecture, protecting CUI and defense technical data across multi-site operations.
Partner with the FSO and program security to lead digital architecture, technical authorization packages, and continuous monitoring for Secret, Top Secret, and Special Access Program systems in alignment with RMF, JSIG, NIST SP 800-53, and DCSA standards.
Establish an enterprise cyber risk register and communicate technical vulnerabilities as operational and business risk metrics to executive leadership and the Board of Directors.
Partner with IT, DevOps, and Digital Manufacturing to implement Zero Trust network segmentation, Entra ID identity governance, and endpoint detection across shop floors, test stands, and cloud environments.
Coordinate with the FSO and physical security teams to align cyber defenses with physical enclave controls, COMSEC, and cleared-personnel governance.
Serve as executive authority for technical and cyber assessments, partnering with the FSO on DCSA security reviews, customer audits, DCMA evaluations, and third-party CMMC assessments.
Build public-company-grade cybersecurity governance, including incident response playbooks, third-party vendor risk management, SEC disclosure readiness, and SOX IT General Controls.
Act as senior escalation authority for incident handling, crisis communications, threat intelligence integration, and technical remediation.