Information Assurance Lead - Governance, Risk, Compliance

Axiom Space is a human space exploration company, building era-defining space infrastructure and delivering technology-driven solutions that will empower civilization to transcend Earth. Beginning with Axiom Station, successor to the International Space Station, the company is pioneering a next-generation orbital settlement that will foster groundbreaking innovation and research in microgravity and drive the global space economy of tomorrow. Today, guided by the vision of leading humanity's expansion off planet, Axiom Space is the principal provider of commercial human spaceflight services and developer of advanced spacesuits for the Moon and beyond. For more information about Axiom Space, visit www.axiomspace.com . Axiom Space fosters a work environment inclusive of all perspectives. We are the pioneers of commercial space, leading the transformation of low-Earth orbit into a global space marketplace. Our mission-driven team is seeking a bold and dynamic Information Assurance Lead who is fueled by high accountability, execution horsepower, and driven to understand our world, science/technology, and life itself, for the benefit of all on Earth and beyond. POSITION SUMMARY Since Axiom Space is a very complex work environment, we are looking for a resilient, high-energy Information Assurance Lead. The Information Assurance (IA) Lead provides the strategic direction and technical oversight necessary to ensure Axiom Space systems and processes meet rigorous security, regulatory, and compliance obligations. This role bridges the gap between high-level governance and technical execution through a threat-informed defense strategy. You will lead the effort to proactively safeguard digital assets, govern security standards, and ensure the integrity of data across our mission-critical infrastructure, including compliance with NIST 800-53/171, CMMC, and ITAR/Export Control regulations. KEY DUTIES & RESPONSIBILITIES Strategic Oversight: Lead the design and implementation of the Information Assurance roadmap, ensuring all internal and customer-facing systems align with the organizational risk appetite and modern threat landscapes. Audit Leadership: Function as the primary point of contact and lead for all security audits and certifications (NIST, CMMC, ISO 27001). Technical Risk Management: Oversee technical security assessments and threat modeling for complex networks. Utilize frameworks like MITRE ATT&CK to model adversary tactics, techniques, and procedures (TTPs), identify deviations from policy and authorize remediation strategies based on recognized countermeasures. Cross-Functional Collaboration: Partner with Engineering, Legal, and Program stakeholders to integrate robust security controls and defensive mitigations into the system development life cycle (SDLC). Third-Party Risk Management: Lead the integration of cybersecurity requirements into the procurement lifecycle; partner with Safety and Mission Assurance to define technical security baselines for suppliers and manage the end-to-end audit process to ensure compliance with NIST 800-53/171 and CMMC standards. Process Innovation: Drive automation in the compliance space by integrating security tooling (SIEM, GRC platforms, etc.) to create a continuous monitoring environment, mapping alerts, and telemetry to MITRE frameworks to ensure comprehensive defensive coverage. Executive Reporting: Translate complex security risks into business contexts for leadership, providing actionable insights on emerging adversary trends, defensive readiness, and regulatory changes. Agile Project Management: Implement and maintain agile project management methodologies throughout the project lifecycle. Performs other duties as assigned. QUALIFICATIONS: To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Education & Experience Bachelor’s degree in Information Security, Cybersecurity, Computer Science, or a related discipline; or equivalent practical experience, defined as 8+ years of progressively responsible experience in Information Assurance, Cybersecurity, Risk Management, or IT Audit. Minimum of 8+ years in technical cybersecurity roles, including at least 3 years with a primary focus on cybersecurity compliance, governance, risk, or audit functions. Certifications: Relevant industry certifications strongly preferred, such as CISSP, CISM, CISA, GSNA, CCA, or comparable credentials demonstrating expertise in security leadership, governance, and assurance. Technical Depth: Demonstrated expert-level knowledge of NIST cybersecurity frameworks (e.g., SP 800-53, SP 800-171), CMMC requirements, and the safeguarding of sensitive, regulated, and export-controlled information (ITAR/EAR), and practical application of threat informed defense models (MITRE ATT&CK/D3FEND/SPARTA). Track record of making things happen in ambiguous, fast-moving environments. Uses good judgement to problem-solve proactively, positively impacting hard challenges. Demonstrated organization skills to meet tight deadlines with high-quality results. Core Skills Passion for space and the mission Entrepreneurial, growth mindset High EQ and ability to collaborate within teams and cross-functionally Tech-solutioning in using systems and tools to move smarter and faster Core Competencies: Embody our core values of leadership , innovation , and teamwork. In addition, to perform the job successfully, an individual should demonstrate the following competencies: Accountability Technical Rigor Execution Discipline Pride of Delivery WORK ENVIRONMENT: Generally, an office environment, but can involve inside or outside work depending on the task. Requirements This position may require access to export controlled technical data or technology subject to NASA regulations, International Traffic in Arms Regulations (ITAR), or Export Administration Regulations (EAR). In accordance with U.S. export control laws, final candidates may be required to undergo additional export control screening to determine eligibility for access. Meeting these requirements is a condition of employment. Management has the prerogative to select at any level for which the position is advertised. Must be willing to work evenings and weekends as needed to meet critical project milestones. Physical Requirements Work may involve sitting or standing for extended periods (90% of the time) May require lifting and carrying up to 25 lbs. (5% of the time) Equipment and Machines Standard office equipment (PC, phone, printer, etc.) Axiom Space is proud to be an equal opportunity employer. Axiom Space does not discriminate on the basis of race, regional color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with disability, or other applicable legally protected characteristics.