Chief Information Security Officer (CISO) - based in Crete

About the role

The International Airport of Heraklion, Crete S.A. is looking for a Chief Information Security Officer (CISO) based in Crete. The role covers the airport's information security governance, its ISO/IEC 27001-aligned Information Security Management System (ISMS), and cybersecurity governance supporting aerodrome certification and EASA compliance.

Key responsibilities

• Develop, implement and maintain the airport's information security governance framework, policies and procedures
• Establish and continuously improve an ISO/IEC 27001-aligned ISMS
• Lead security governance initiatives and promote a strong security culture
• Coordinate management reviews, governance reporting, audits and certification activities
• Maintain the risk management methodology and risk register, facilitate risk assessments and monitor mitigation plans
• Support operational resilience and business continuity initiatives
• Lead cybersecurity governance for aerodrome certification and EASA Part-IS compliance, including inspections, evidence submissions and finding closure
• Act as main contact for the Hellenic Civil Aviation Authority, National Cybersecurity Authority, EASA and other authorities
• Monitor NIS2, GDPR security obligations, aviation regulations and contractual commitments, and coordinate regulatory submissions and audits
• Support supplier due diligence and third-party security risk management

Required profile

• Bachelor's degree in IT, Business Administration, Law or a related discipline, or equivalent experience
• Master's degree in IT, Cybersecurity, Risk Management or related field is a plus
• At least 5 years in information security governance, risk and compliance, cybersecurity risk management, compliance or information systems auditing
• Professional certifications such as CISSP, CISM or CRISC are an asset
• Demonstrated experience establishing, maintaining or improving an ISO/IEC 27001-based ISMS
• Experience in aviation, transport, critical infrastructure or another highly regulated sector, and familiarity with EASA Part-IS requirements

Required skills

• Understanding of NIS2 and GDPR security requirements
• Enterprise security architecture across IT, cloud and OT/ICS environments
• Managing audits, regulatory assessments and compliance programs
• Strong stakeholder management, communication and analytical skills, and ability to turn technical risks into business decisions