Associate Director, Information Systems Security

## Company Overview Iridium is an award-winning satellite communications company operating the world's only truly global voice and data network, delivering reliable connectivity anywhere on Earth. For more than 20 years, Iridium has powered mission-critical communications for governments, businesses, aviation, maritime, and the rapidly expanding Internet of Things.

Now part of Iridium, Aireon is the world’s only space-based air traffic surveillance system, providing real-time visibility of aircraft over oceans, the poles, and remote regions. Together, Iridium and Aireon are helping build a safer, more connected, and more efficient future for global aviation. Join our team and help shape how the world stays connected.

We foster a collaborative, inclusive culture where employees are empowered to innovate, grow professionally, and make a meaningful impact. ## What We’re Looking For The Associate Director of Information Systems Security is responsible for the oversight and operational implementation of Aireon’s Information and Cyber Security programs.

Reporting to the Director of IT Security and operating under the authority of Aireon’s Accountable Executive, this role owns the execution, performance, and continuous improvement of Aireon’s ATS Information Security Management System (ATS‑ISMS) as defined in the ATS‑ISMM, ensuring compliance with EASA Part‑IS.

Serving as Aireon’s operational focal point for information security across Engineering and Operations, this role translates executive security objectives into practical, measurable, and effective operational practices that protect the confidentiality, integrity, and availability of systems essential to global aviation safety. ## What You’ll Do - Own and operate Aireon’s ATS Information Security Management System (ATS‑ISMS), ensuring all policies, processes, and controls remain compliant with EASA Part‑IS - Manage and oversee personnel responsible for ATS‑ISMS activities, ensuring appropriate staffing, competency management, training, and performance oversight consistent with EASA Part‑IS requirements. - Lead workforce planning and capability development efforts to maintain an effective security function capable of meeting evolving operational, regulatory, and cybersecurity demands. - Lead information security risk management activities, including structured risk assessments, development of Risk Treatment Plans (RTPs), and facilitation of residual risk acceptance in coordination with the CISO and Accountable Manager - Direct the Cyber Security Incident Response Team (CSIRT) across the full incident lifecycle: detection, triage, containment, eradication, recovery, and lessons learned - Manage Aireon’s response to findings from competent authorities (EASA and others), driving corrective action plans (CAPs) through timely and effective closure - Oversee Aireon’s external information security reporting scheme, ensuring accurate and timely notification to relevant authorities and stakeholders per IS.I.OR.230 - Oversee third‑party and supplier security within the ATS‑ISMS, ensuring vendors meet Aireon’s security requirements and undergo structured risk assessment and ongoing oversight - Coordinate personnel security requirements within the ATS‑ISMS, including screening, competence management, and security awareness activities - Support secure software development lifecycle practices by ensuring security requirements and controls are embedded across cross-functional engineering and operations teams - Develop and maintain security metrics and executive‑level reporting, providing data‑driven insights to the VP of Engineering & Operations and senior leadership on posture, risk trends, and program performance - Drive continuous improvement of the ATS‑ISMS through internal audits, post‑incident reviews, and systemic remediation of findings - Represent Aireon in information security matters with industry bodies (CANSO, ICAO, EASA), contributing to discussions on policy and standards as appropriate ## What You’ll Need to Succeed - Bachelor’s degree in information technology, cybersecurity, or a related discipline; professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or equivalent required - 12+ years of progressive experience in information security, with at least 3 years in a security leadership role managing people and security programs within critical infrastructure or high-availability operational environments - Demonstrated experience operating or overseeing an Information Security Management System (ISMS) aligned with EASA Part-IS, NIST 800-53, NIST 800-171, and/or ISO/IEC 27001 - Proven experience leading incident response (CSIRT/ Computer Emergency Response Team (CERT)) operations, including managing the full incident lifecycle from detection through lessons learned - Strong knowledge of risk management frameworks and experience conducting formal risk assessments, developing treatment plans, and managing residual risk - Experience managing third-party/supplier security programs, including vendor risk assessments and contractual security controls - Excellent communication skills - able to translate complex security concepts for non-technical executive audiences and represent the organization externally - Experience with audit and assessment processes - identifying vulnerabilities, managing findings, and demonstrating regulatory compliance - Familiarity with aviation industry security requirements and regulatory bodies (EASA, ICAO, CANSO) is strongly preferred ## Things That Would be Great if You Brought to the Table - Experience working within an Air Traffic Services (ATS) or aviation operational technology environment - Familiarity with EASA Part-IS requirements and the ATS-ISMM governance framework - Experience implementing zero trust architecture in a complex, distributed network environment - Knowledge of safety management systems (SMS) and the intersection of safety and security risk - Experience engaging with national or international regulatory authorities on security compliance - Advanced qualifications such as Certified in Risk and Information Systems Control (CRISC), Certified in the Governance of Enterprise IT (CGEIT), or Sherwood Applied Business Security Architecture (SABSA) ## We’ll also need you to - Be able to work in the office at least 4 or more days a week to foster collaboration with the team and stakeholders - Be a US Citizen ## Work Environment This position primarily works in an office setting and is largely sedentary with the majority of the position working with a computer.

The role typically requires the use of basic office equipment such as a phone, video, computer, keyboard, mouse, and printer. We believe in-person connection drives innovation, strengthens mentorship, and builds culture, while flexibility enables employees to do their best work.

Under Iridium’s Hybrid Work Policy, employees are expected to work at least four days per week (approximately 80%) in an Iridium office to support collaboration, relationship-building, and professional growth. ## Additional Information This job description outlines the general nature and level of work for this role and is not a comprehensive list of duties, responsibilities, or qualifications.

Employees may be assigned additional responsibilities as needed. Base Pay Range: $175,000 - $228,000 USD Actual compensation will be determined based on a variety of factors and this range represents an estimate of compensation at the time of posting. Base salary is only one part of our compensation package for this role. You may also be eligible for company stock and annual bonus.

Employee benefits also include medical, dental, and vision insurance coverage; 401(k) retirement plan options; paid time off and paid holidays; paid parental leave; and other discounts and perks.