Chief Information Security Officer - CISO (based in Crete)

<h2>International Airport of Heraklion, Crete S.A. is currently looking for a:</h2><h2>Chief Information Security Officer – CISO (based in Crete)</h2><h2>Responsibilities</h2><ul>
<li>Develops, implements, and maintains the Airport’s information security governance framework, policies, and procedures</li>
<li>Establishes and continuously improves an ISO/IEC 27001-aligned Information Security Management System (ISMS)</li>
<li>Leads security governance initiatives and promotes a strong security culture across the organization</li>
<li>Coordinates management reviews, governance reporting, audits, and certification activities</li>
<li>Maintains the information security risk management methodology and risk register</li>
<li>Facilitates risk assessments across business functions and critical systems</li>
<li>Monitors mitigation plans and escalates significant residual risks</li>
<li>Supports operational resilience and business continuity initiatives</li>
<li>Leads cybersecurity governance activities supporting aerodrome certification and continuous compliance with EASA requirements, particularly Part-IS</li>
<li>Coordinates inspections, compliance reviews, evidence submissions, and closure of findings</li>
<li>Ensures effective alignment between cybersecurity, aviation safety, and aviation security requirements</li>
<li>Serves as the primary point of contact for information security matters with the Hellenic Civil Aviation Authority (HCAA), National Cybersecurity Authority, EASA, and other relevant authorities</li>
<li>Monitors compliance with NIS2, GDPR security obligations, aviation regulations, and contractual commitments</li>
<li>Maintains the information-security obligations register and monitors relevant regulatory developments</li>
<li>Coordinates regulatory submissions, audits, inspections, and follow-up actions</li>
<li>Supports supplier due diligence and third-party security risk management</li>
</ul><h2>Requirements</h2><ul>
<li>Bachelor’s degree in IT, Business Administration, Law, or a related discipline, or equivalent relevant professional experience</li>
<li>Master’s degree in IT, Cybersecurity, Risk Management or related discipline will be considered a plus</li>
<li>Minimum 5 years of experience in Information Security Governance, Risk &amp; Compliance (GRC), cybersecurity risk management, compliance, or information systems auditing</li>
<li>Professional certifications (e.g. CISSP, CISM, CRISC) will be considered an asset</li>
<li>Demonstrated experience establishing, maintaining, or improving an ISO/IEC 27001-based ISMS</li>
<li>Experience managing audits, regulatory assessments, and compliance programs</li>
<li>Strong understanding of NIS2, GDPR security requirements and enterprise security architecture across IT, Cloud, OT/ICS environments</li>
<li>Experience within aviation, transport, critical infrastructure, or another highly regulated sector</li>
<li>Familiarity with EASA Part-IS requirements</li>
</ul><h2>Competencies</h2><ul>
<li>Strategic thinking and business awareness</li>
<li>Excellent stakeholder management and communication skills</li>
<li>Strong analytical and problem-solving capability</li>
<li>Ability to translate complex technical risks into business decisions</li>
<li>High integrity, independence, and discretion when handling sensitive or confidential information</li>
</ul>