Principal Director - Cyber / Information Security, and Head of the Information Security Office

The Aerospace Corporation is the trusted partner to the nation’s space programs, solving the hardest problems and providing unmatched technical expertise. As the operator of a federally funded research and development center (FFRDC), we are broadly engaged across all aspects of space— delivering innovative solutions that span satellite, launch, ground, and cyber systems for defense, civil and commercial customers. When you join our team, you’ll be part of a special collection of problem solvers, thought leaders, and innovators. Join us and take your place in space.

Job Summary

The CISO will be responsible for implementing and running the enterprise cybersecurity program. That will involve identifying, evaluating and reporting on legal and regulatory, IT, and cybersecurity risk to information assets, while supporting and advancing business objectives.

The CISO position requires a visionary leader with sound knowledge of business management and a working knowledge of cybersecurity technologies covering the corporate network as well as the broader digital ecosystem. The CISO is responsible for establishing and maintaining the cybersecurity program to ensure that information assets and associated technology, applications, systems, infrastructure and processes are adequately protected in the digital ecosystem in which we operate.

A key element of the CISO's role is working with executive management to determine acceptable levels of risk for the organization. They will proactively work with business units and ecosystem partners, including customer stakeholders, to implement practices that meet agreed-on policies and standards for cybersecurity. The CISO should understand and articulate the impact of cybersecurity on (digital) business and be able to communicate this to the board of directors and other senior stakeholders.

The CISO must be knowledgeable about both internal and external business environments and ensure that information systems are maintained in a fully functional and secure mode and are compliant with legal, regulatory and contractual obligations. They serve as the process owner of the appropriate second-line assurance activities not only related to confidentiality, integrity and availability of information owned or processed by the business but extend their expertise to aid the organization in meeting safety, privacy, reliability, and resilience requirements. The CISO understands that securing information assets and associated technology, applications, systems, and processes in the wider ecosystem in which the organization operates is as important as protecting information within the organization's perimeter.

The ideal candidate is a thought leader, a builder of consensus and of bridges between business and technology. They are an integrator of people, process and technology. While the CISO is the leader of the cybersecurity program, they must also be able to coordinate disparate drivers, constraints and personalities, while maintaining objectivity and a strong understanding that cybersecurity is foundational for the organization to deliver on its business goals and objectives. Ultimately, the CISO is a business leader, and should have a track record of competency in the field of cybersecurity and/or risk management, with seven to 10 years of relevant experience, including five years in a significant leadership role.

The selected candidate will be required to work full-time, on-site at one of our locations in El Segundo, CA; Colorado Springs, CO; Crystal City, VA; or Chantilly, VA.

What You’ll Be Doing

Establish Governance and Build Knowledge

• Facilitates a cybersecurity governance structure through the implementation of a hierarchical governance program.
• Provides regular reporting on the current status of the cybersecurity program to enterprise risk teams, senior business leaders and the board of trustees as part of a strategic enterprise risk management program, thus supporting business outcomes.
• Develops, socializes and coordinates approval and implementation of security policies.
• Works with the Supply Chain team to ensure that cybersecurity requirements are included in contracts by liaising with vendor management and procurement organizations.
• Directs the creation of a targeted cybersecurity awareness training program for all employees, contractors and approved system users, and establishes metrics to measure the effectiveness of this security training program for the different audiences.
• Understands and interacts with related disciplines, either directly or through committees, to ensure the consistent application of policies and standards across all technology projects, systems, and services, including privacy, risk management, compliance and business continuity management.
• Advises on the cyber ri