Associate Director, Information Systems Security

Company Overview

Iridium is an award-winning satellite communications company operating the world's only truly global voice and data network, delivering reliable connectivity anywhere on Earth. For more than 20 years, Iridium has powered mission-critical communications for governments, businesses, aviation, maritime, and the rapidly expanding Internet of Things.

Now part of Iridium, Aireon is the world’s only space-based air traffic surveillance system, providing real-time visibility of aircraft over oceans, the poles, and remote regions. Together, Iridium and Aireon are helping build a safer, more connected, and more efficient future for global aviation.

Join our team and help shape how the world stays connected. We foster a collaborative, inclusive culture where employees are empowered to innovate, grow professionally, and make a meaningful impact.

What We’re Looking For:

The Associate Director of Information Systems Security is responsible for the oversight and operational implementation of Aireon’s Information and Cyber Security programs. Reporting to the Director of IT Security and operating under the authority of Aireon’s Accountable Executive, this role owns the execution, performance, and continuous improvement of Aireon’s ATS Information Security Management System (ATS‑ISMS) as defined in the ATS‑ISMM, ensuring compliance with EASA Part‑IS.

Serving as Aireon’s operational focal point for information security across Engineering and Operations, this role translates executive security objectives into practical, measurable, and effective operational practices that protect the confidentiality, integrity, and availability of systems essential to global aviation safety.

What You’ll Do:

Own and operate Aireon’s ATS Information Security Management System (ATS‑ISMS), ensuring all policies, processes, and controls remain compliant with EASA Part‑IS

Manage and oversee personnel responsible for ATS‑ISMS activities, ensuring appropriate staffing, competency management, training, and performance oversight consistent with EASA Part‑IS requirements.

Lead workforce planning and capability development efforts to maintain an effective security function capable of meeting evolving operational, regulatory, and cybersecurity demands.

Lead information security risk management activities, including structured risk assessments, development of Risk Treatment Plans (RTPs), and facilitation of residual risk acceptance in coordination with the CISO and Accountable Manager

Direct the Cyber Security Incident Response Team (CSIRT) across the full incident lifecycle: detection, triage, containment, eradication, recovery, and lessons learned

Manage Aireon’s response to findings from competent authorities (EASA and others), driving corrective action plans (CAPs) through timely and effective closure

Oversee Aireon’s external information security reporting scheme, ensuring accurate and timely notification to relevant authorities and stakeholders per IS.I.OR.230

Oversee third‑party and supplier security within the ATS‑ISMS, ensuring vendors meet Aireon’s security requirements and undergo structured risk assessment and ongoing oversight

Coordinate personnel security requirements within the ATS‑ISMS, including screening, competence management, and security awareness activities

Support secure software development lifecycle practices by ensuring security requirements and controls are embedded across cross-functional engineering and operations teams

Develop and maintain security metrics and executive‑level reporting, providing data‑driven insights to the VP of Engineering & Operations and senior leadership on posture, risk trends, and program performance

Drive continuous improvement of the ATS‑ISMS through internal audits, post‑incident reviews, and systemic remediation of findings

Represent Aireon in information security matters with industry bodies (CANSO, ICAO, EASA), contributing to discussions on policy and standards as appropriate

What You’ll Need to Succeed:

Bachelor’s degree in information technology, cybersecurity, or a related discipline; professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or equivalent required

12+ years of progressive experience in information security, with at least 3 years in a security leadership role managing people and security programs within critical infrastructure or high-availability operational environments

Demonstrated experience operating or overseeing an Information Security Management System (ISMS) aligned with EASA Part-IS, NIST 800-53, NIST 800-171, and/or ISO/IEC 27001

Proven experience leading incident response (CSIRT/ Computer Emergency Response Team (CERT)) operations, including managing the full incident lifecycle from detection through lessons learned

Strong knowledge of risk management frameworks and experience conducting formal risk assessments, developing treatment plans, and managing residual risk

Experience managing third-party/supplier security programs, including vendor risk assessments and contractual security controls

Excellent communication skills — able to translate complex security concepts for non-technical executive audiences and represent the organization externally

Experience with audit and assessment processes — identifying vulnerabilities, managing findings, and demonstrating regulatory compliance

Familiarity with aviation industry security requirements and regulatory bodies (EASA, ICAO, CANSO) is strongly preferred

Things That Would be Great if You Brought to the Table:

Experience working within an Air Traffic Services (ATS) or aviation operational technology environment

Familiarity with EASA Part-IS requirements and the ATS-ISMM governance framework

Experience implementing zero trust architecture in a complex, distributed network environment

Knowledge of safety management systems (SMS) and the intersection of safety and security risk

Experience engaging with national or international regulatory authorities on security compliance

Advanced qualifications such as Certified in Risk and Information Systems Control (CRISC), Certified in the Governance of Enterprise IT (CGEIT), or Sherwood Applied Business Security Architecture (SABSA)

We’ll also need you to:

Be able to work in the office at least 4 or more days a week to foster collaboration with the team and stakeholders

Be a US Citizen

Work Environment:

This position primarily works in an office setting and is largely sedentary with the majority of the position working with a computer. The role typically requires the use of basic office equipment such as a phone, video, computer, keyboard, mouse, and printer.

We believe in-person connection drives innovation, strengthens mentorship, and builds culture, while flexibility enables employees to do their best work. Under Iridium’s Hybrid Work Policy, employees are expected to work at least four days per week (approximately 80%) in an Iridium office to support collaboration, relationship-building, and professional growth.

Additional Information

This job description outlines the general nature and level of work for this role and is not a comprehensive list of duties, responsibilities, or qualifications. Employees may be assigned additional responsibilities as needed.

Base Pay Range: $175,000 - $228,000 USD