Cybersecurity / InfoSec Lead

We are seeking an information security expert who has experience helping startups meet IT requirements for satisfying government contractor requirements and corporate governance. The ideal candidate will have direct experience leading efforts to structure, deploy and manage data and information security protocols including: secure phones, laptops, and company servers (both local and cloud-based) – as well as working across enterprise software platforms, and directly with vendors, to achieve compliance for CMMC Level 2, experience with financial controls, and related protocols as required. This person will lead strategic initiatives, including the establishment of a CUI enclave, and support day-to-day operations to keep the company’s IT secure.

Key Responsibilities:

• Data Retention and Practices: Develop and implement data and information storage, retention, and access management.Develop strategies and build culture around data and information best practices.
• Risk Management: Identify, assess, and prioritize IT security risks. Deploy and maintain appropriate systems, build and enforcing a culture of connectivity, efficiency, and security.
• Security Compliance:
• Support the selection and adoption of information security practices for financial controls as the company stands up ERP/MRP systems
• Draft company policies and lead IT security best practices for the entire company including access controls for research, engineering, production, and financial data across company functions and information systems
• Achieve and maintain compliance with federal cybersecurity approaches, including both internal company-wide efforts to shift from the practices of an early-stage startup to those of a CMMC Level 2 federal contractor and external efforts to manage vendors.

IT Operations: As a startup, this role requires flexibility to support broader IT needs beyond security, including:

• End-user technical support and help desk functions
• Mobile Device Management (MDM) configuration and administration (e.g., Jamf, Intune, Kandji)
• Identity and access management (e.g., Okta, Azure AD, JumpCloud)
• High-Performance Computing (HPC) systems administration
• Network engineering and infrastructure management

Qualifications:

• Proven ability to partner with Engineering, HR, and Operations to embed security and compliance practices into daily workflows.
• Proven ability to deploy, configure, and maintain SIEM, vulnerability management, and endpoint protection platforms (e.g., Microsoft Defender, Sentinel, CrowdStrike).
• A track record of implementing and maintaining compliance with NIST SP 800-171.
• Direct involvement in achieving and sustaining CMMC Level 2 certification, including coordination with external assessors and audit-ready evidence preparation.
• Hands-on experience designing, deploying, and administering Controlled Unclassified Information (CUI) enclaves, including data migration —preferably in Microsoft GCC.
• Experience drafting and enforcing IT and cybersecurity policies (access control, acceptable use, incident response, media protection, etc.) aligned with NIST/CMMC frameworks.
• Proven experience (5+ years), ideally supporting rapidly scaling hardware startups onboarding government contracts.
• Hands-on experience with general IT operations including MDM platforms, identity providers, network infrastructure, and end-user support in a fast-paced environment.
• American Citizenship.

Work Location: Remote or Hybrid (in the Bay Area)

Base Salary Range: $85,000 - $165,000 USD

Salary Basis: Annual

This job posting contains the base salary range that xLight believes it would be willing to pay for the posted job. The actual salary offered will be determined within the posted range based on a candidate's experience, credentials, and expertise as they pertain to the requirements of the position. Geographical factors may also be a consideration. In addition to a competitive base salary, xLight offers health benefits packages with life and disability insurance, a 401K plan, a flexible spending account, paid time off, and long-term incentive compensation.

Equal Opportunity Statement

xLight Inc. is an Equal Opportunity Employer. Selection for roles will be based on individual merit alone.

No Recruiters – Applicants must apply directly