PMCs like Xe etc. are not a good example of military contractors. They are only a small fraction of all of the private military contractors out there. And no, one doesn't have to have prior service or be American to work for a private contractor. A large majority of private contractors provide logistics, communications, and other professional services. There is a big difference between a Private Military Company that actually does the fun stuff and a General Contractor that provides construction, electrical, plumbing, communications, food, transportation, medics, etc. etc.
Maybe your friend doesn't undestand that "private contractor" does not equal running and gunning with the tier 1 guys at a PMC. Even Blackwater guys have to eat, drop a deuce, and email. They also will not put a good tier 1 guy at the front gate of a camp doing car searches so he can get blown up. Other people do that stuff, but they still work for the company.
A security firm may not be what most think of as a PMC. A security firm might be hiring Africans, Samoans, Gurka, South Africans, Kiwis, etc. etc. to do anything from checkpoints, training, K9, etc. This is not top tier talent and while usually requiring some past experience in whatever trade they are hired for, it does not require US citizenship or any elite experience. The real deal guys doing all the cool high speed stuff are almost always, 99.9999999 percent of the time, prior mil or at the very very least had a long career in LE with a specific skillset. Most working for US companies are from the US but you may see some from Australia, New Zealand, South Africa, the Uk, etc. They may be split up into different teams, some require US citizenship, some don't and will be of mixed nationality. It all depends on the requirements of the contract.