Principal Specialist, Cyber security & Risk Management

Date Posted:

Country:

Germany

Location:

DE-HE-FRANKFURT-AIRPORT-CUST Airportring 322 BLDG 335 Zweigniederlassung Deutschland (External Site)

Position Role Type:

Unspecified

Role Overview - Information System Security Officer ISSO

We are seeking a highly experienced and strategic Information System Security Officer to lead our cyber and regulatory compliance programs across RTX business units for sites located in Germany. This role is critical for ensuring the cyber posture of the sites and for establishing the guidelines and actions needed to protect the companys Information Systems against cyber threats responds to digital compliance risks and fosters a company-wide culture of cybersecurity.

The successful candidate will provide technical leadership oversee multi-site governance and risk management and ensure alignment between RTX ES Cybersecurity services (including IT and OT) with Business functions to safeguard critical assets applications systems and data.

The candidature is expected to follow a hybrid work model balancing remote and on-site presence based on business needs key meetings critical milestones team collaboration needs audits or incident response requirements.

What will you do

Governance:

• Ensure the management and local cyber governance of the Information Systems within the sites under ISSO scope.
• Ensure adherence to global and regional/local regulatory requirements and applicable frameworks (ISO NIST SP800-171 etc.).
• Maintain the Information Security Management System (ISMS) or equivalent governance model.
• Define implement coordinate manage and monitor activities related to the Part-IS regulation (acting as Aviation Safety ISMS Manager).
• Drive internal and external audits certifications and compliance readiness across multiple sites.
• Continuous monitoring of emerging regulations and standards ensuring proactive & compliance and risk management.
• Ensure relationship and interface with cyber stakeholders in relation with site ecosystem including security authorities customers & partners.
• Define derive and maintain security policies procedures and guidance for Restricted and Classified IS located on site (if any) and ensure their implementation with the support of DT team.
• Ensure accreditation activities on Restricted and Classified networks (when applicable).
• Develop and execute an annual security awareness plan to reduce business compliance risks cyber operational risks and to foster a cyber culture within the sites.

Cyber Risk Management:

• Manage cyber risks (identification evaluation and treatment) according to applicable enterprise-wide cyber risk program and regulations including but not limited to Part-IS and NIS2. As part of the risk management the ISSO will perform/lead risk assessment for the sites and associated risk treatment plans with the support of DT Intl Operations and RTX Global GRC teams.
• Oversee implementation of security controls (technical administrative physical) for applications infrastructure Cloud and OT systems under ISSO scope.
• Ensure secure enablement of new technologies and digital transformation programs.

Compliance:

• Ensure compliance with applicable security requirements for the sites (internal policies applicable regulations and customer frameworks).
• Ensure compliance with applicable security requirements for the third parties engaged with the sites (internal policies applicable regulations and customer frameworks). Drive supplier cyber risks identification and treatment for the sites.
• Support enterprise-wide compliance program (e.g. DT Assessment Part-IS internal audit) and external audit/assessment from customers and regulators (e.g. CASE audit).

Security event and incident management:

• Ensure that threat detection capabilities provided by RTX Cyber-Defense team are fully implemented.
• Monitor Detect and Respond to cyber threats exposing Restricted and Classified networks (when applicable).
• Support the RTX Cyber-Defense Operations for any event or incident occurring on the sites. Drive incident response preparedness and act as point of contact for security incidents.

Operations:

• Provide expert security guidance to DT Intl Operations (e.g. vulnerability management remediation plan execution support on new cyber programs).
• Support special cyber programs such as SURGE and drive critical vulnerabilities remediation in support to DT Intl operations and CART team.
• Champion business resilience by aligning DT and OT security strategies with business continuity and disaster recovery plans.
• Provide support to the DT team on activities related to business continuity/recovery (BIA DRP etc.).

Technical Leadership:

• Act as the point of contact for various compliance programs (e.g. EASA Part-IS NIS2 DFARS CMMC Global etc.) where applicable.
• Provide expert security guidance to Engineering Operations and Value-Stream Leaders teams. Especially the ISSO will provide support to business programs and pursuits.
• Collaborate with local stakeholders (e.g. Engineering Operations Safety Quality) to ensure seamless integration of information security requirements.
• Represent Information Security with external regulators customers and partners.
• Monitor regulatory threat landscape and technology evolution in cybersecurity.
• Mentor and develop junior security professionals promoting a cybersecurity culture.

Qualifications you must have

• Masters degree in Computer Science Information Security Engineering or related field with 8 years of experience in cybersecurity.
• Knowledge or experience in the following domains (at least 5): Risk Management Security Architecture & Engineering Asset Security Communication & Network security Security Assessment and Testing IAM Security Operations.
• Strong working knowledge of security frameworks: ISO NIST (CSF SP800-171 SP800-82) etc.
• Experience leading multi-site/global compliance programs.
• Excellent knowledge of risk management methodologies and audit practices.
• Strong communication and stakeholder management skills at C level.
• Relevant certifications (one or more): CISSP CISM CRISC ISO 27001 Lead Implementer/Auditor ISO 27005 Risk Manager OSCP CEH GIAC etc.

Qualifications we prefer

• Experience in regulated industries (e.g. aerospace defence manufacturing or critical infrastructure).
• Knowledge on EASA Part-IS NIS2 national MoD security regulations.
• Experience working with/for regulators/authorities or customers (e.g. Aerospace & Defense OEMs).
• Experience and expertise in the following security fields: threat monitoring & detection security incidents mgt penetration testing and/or technical audit software development security (threat modeling secure coding).
• Familiarity with Industrial Control Systems (ICS) / OT cybersecurity.
• Background in safety-critical or regulated environments.

Soft skills:

• Demonstrate ownership and accountability for assigned projects/programs.
• Curious passionate.
• Ability to withstand pressure.
• Ability to work across the organization.
• Ability to influence.
• Ability to report back to management.
• Team management.
• Sense of general interest committed.

Nationality/Clearance: this job may require having national security clearance. Must be eligible to obtain a higher security clearance.

RTX adheres to the principles of equal employment. All qualified applications will be given careful consideration without regard to ethnicity color religion gender sexual orientation or identity national origin age disability protected veteran status or any other characteristic protected by law.

Privacy Policy and Terms:

Click on this link to read the Policy and Terms

Required Experience:

Staff IC

Employment Type : Full-Time
Experience: years
Vacancy: 1