Chief Information Security Officer (CISO)

The future of aerospace and defense starts here.

Ursa Major was founded to revolutionize how America and its allies access and apply high-performance propulsion, from hypersonics to solid rocket motors, satellite maneuvering and launch. We design and deliver propulsion and defense systems that solve the most urgent and critical national security demands.

Our mission requires an extraordinary team, specifically one that will mold tomorrow's critical technologies while deploying today's best. We are an intrinsically motivated organization with a passion for solving complex technical problems and empowering each other every day, knowing that there is always room for growth.

About The Role

Ursa Major is seeking an executive technology leader to serve as our Chief Information Security Officer (CISO w/ clearance)

. Reporting to the executive leadership team, the CISO will establish enterprise-wide information security ownership across our multi-site engineering, manufacturing, and test facilities. Working in direct, strategic lockstep with our Facility Security Officer (FSO), who leads personnel clearances, physical security, and overall NISPOM facility compliance, the CISO serves as the ultimate authority for digital, technical, and operational cybersecurity.

We are not looking for an administrator who leads from behind a desk or relies on enterprise bureaucracy. We need a builder who leads from the front—an executive with deep roots in Aerospace & Defense (A&D) who knows what mature security infrastructure looks like and possesses the hands-on drive to build, scale, and mature our systems from the ground up.

Sitting at the intersection of defense compliance, manufacturing velocity, and enterprise IT, you will own the overarching risk management strategy for both unclassified and classified programs. You will champion our hybrid CMMC Level 2 enclave expansion, govern the technical architecture of classified defense enclaves (Secret / SAP), protect critical Intellectual Property, and establish the cyber risk governance required for a high-growth defense firm preparing for public-company operations.

Responsibilities:

• Define and execute Ursa Major’s enterprise cybersecurity and information assurance strategy across all corporate, manufacturing, engineering, and classified program environments.
• Lead from the front to build, mentor, and inspire a world-class cybersecurity engineering and compliance team, fostering a culture of operational enablement, technical rigor, and deep cross-functional partnership.
• Direct the continuous advancement and accreditation of our CMMC Level 2 / NIST SP 800-171 architecture, ensuring Controlled Unclassified Information (CUI) and defense technical data flow securely across multi-site operations without impeding engineering velocity.
• In close partnership with the FSO and program security, lead the digital architecture, technical authorization packages, and continuous monitoring of classified information systems (Secret, Top Secret, and Special Access Programs) in strict alignment with RMF, JSIG, NIST SP 800-53, and DCSA standards.
• Establish an enterprise cyber risk register, translating technical vulnerabilities into clear operational and business risk metrics for executive leadership and the Board of Directors.
• Partner closely with IT, DevOps, and Digital Manufacturing to embed Zero Trust network segmentation, identity governance (Entra ID), and robust endpoint detection into physical shop floors, test stands, and cloud environments.
• Establish a collaborative, locked-in operating rhythm with the FSO and physical security teams to unify technical cyber defenses with physical enclave controls, COMSEC, and cleared personnel governance.
• Serve as the executive authority for technical and cyber assessments, partnering with the FSO on DCSA security reviews, customer audits, DCMA evaluations, and third-party CMMC assessments (C3PAO).
• Build public-company-grade cybersecurity governance, including incident response playbooks, third-party vendor risk management (TPRM), SEC disclosure readiness, and SOX IT General Controls (ITGC).
• Act as the senior escalation authority for incident handling, crisis communications, threat intelligence integration, and technical remediation.

Minimum Qualifications:

• 12+ years of progressive experience in cybersecurity, information assurance, and secure systems architecture, with at least 5+ years in senior leadership or technical management roles within the Aerospace & Defense (A&D) sector.
• Active U.S. Government Security Clearance (Top Secret required, with active or recent SCI/SAP eligibility preferred).
• Demonstrated track record of partnering successfully with Facility Security Officers (FSOs), government Authorizing Officials (AOs), and program leadership to secure facility authorizations and system ATOs.
• Deep technical and regulatory mastery of federal security standards, including NIST SP 800-171, CMMC Level 2, NIST SP 800-53, Risk Management Framework (RMF), JSIG, and NISPOM.
• Demonstrated ability to lead hands-on technical initiatives, conduct rigorous architectural reviews with engineering teams, and articulate strategic risk and vision to executive leadership and government customers.
• Experience managing enterprise-wide incident response, endpoint detection (EDR), identity federation, and Zero Trust micro-segmentation in hybrid IT/OT manufacturing environments.
• Current industry certification: CISSP, CISM, or equivalent executive-level security credential.

Preferred Qualifications:

• Active TS/SCI with current SAP/SAR access.
• Experience leading an organization through a successful DCSA security inspection or C3PAO CMMC Level 2 assessment.
• Practical familiarity with public-company readiness, including SOX compliance, cyber risk disclosures, and enterprise business continuity planning.
• Master’s degree in Cybersecurity, Computer Science, Information Assurance, or related field.

Colorado law requires us to tell you the base compensation range of this role, which is $240,000 - $300,000, determined by your education, experience, knowledge, skills, and abilities. What we can’t quantify for you are the exciting challenges, supportive team, and amazing culture we enjoy.

Classification: Full-time Exempt