IT & Information Security Manager (AOC Operator Part-IS) FILLED
Location: Malta (on-site hybrid)

Department: Technology, Flight Operations Support & Compliance

Reports to: Accountable Manager (dotted line to Safety Manager & Compliance Monitoring)

Type: Full-time, permanent

Role purpose
Lead all IT operations and cybersecurity for the airline and build/own an Information Security Management System (ISMS) compliant with EASA Part-IS for an AOC setting. You’ll ensure secure, resilient technology for the OCC , Flight Operations , Ground Operations , and Continuing Airworthiness interfaces , maintain the Information Security Management Manual (ISMM) , and manage internal/external reporting and authority oversight with TM-CAD .

Key Responsibilities

Airline IT operations (AOC focus)

Own availability, performance, and security of ops-critical systems: flight planning & dispatch, crew rostering, OCC tools, EFB/EFF, PSS/DCS, weight & balance, load control, slots/NOTAMs, movement control, MRO/CAMO interfaces, ACARS/CPDLC gateways, and network/connectivity (incl. aircraft connectivity & satcom where applicable).

Ensure robust identity/access, endpoint management, and secure collaboration for crew and ground staff (incl. BYOD/EFB if applicable).

Manage vendors, SLAs, budgets; negotiate and govern SaaS/PSS/DCS providers and ground handler/MRO integrations.

Coordinate tightly with Nominated Persons (Flight Ops, Ground Ops, Continuing Airworthiness) to align tools, data flows, and change windows with operational realities.

Part-IS leadership & compliance

Design, implement, and run an ISMS tailored to an AOC operator; maintain the ISMM and keep scope/roles/controls current with fleet, routes, and supplier landscape.

Establish and run internal information-security occurrence reporting linked to the SMS; manage external reporting to the authority for events with potential aviation-safety impact.

Prepare for and host authority oversight; track findings, implement corrective actions,



and maintain evidence for present/suitable/operating/effective stages.

Embed Part-IS requirements into Ops Manuals references (e.g., OM-A governance touchpoints, EFB program), change management, and safety-risk processes.

Risk management, resilience & assurance

Run security risk assessments focused on operational impact (flight safety, dispatch continuity, passenger service disruption); integrate with the SMS and management system.

Implement and test controls: vulnerability and patch management, logging/monitoring/SIEM, privileged access, backup/restore, DR/BCP for OCC/flight-critical systems, and phishing/awareness.

Plan and execute internal audits and exercises (table-top and technical), including EFB compromise drills, OCC loss-of-service scenarios, and third-party compromise simulations.

EFB & operational data protection

Govern the EFB program security (device hardening, content management, revision control, secure distribution, offline integrity, incident response).

Safeguard operational datasets (flight plans, MEL/defects, crew data, movement & turnaround data, weight & balance, PNR/APIS/PNLG if handled) with appropriate classification and controls.

Third-party & supply-chain security

Build and enforce supplier due diligence and contractual security clauses for PSS/DCS, ground handlers, MRO/CAMO partners, catering/PRM providers, and airport/IT MSPs.

Monitor interfaces and data exchange (APIs, SFTP, AIDX/EDIFACT, message brokers) and ensure secure onboarding/off-boarding.

Governance, training & culture

Chair the ISMS steering forum; provide clear risk dashboards and briefings to the Accountable Manager, Safety Board, and EXCO.

Define responsibilities (e.g.,



Information Security Manager role, EFB Admin, Local Security Coordinators in OCC/Stations) and deliver role-based training and recurrent awareness.

Required Profile

Degree in IT/Computer Science/Engineering (Master’s a plus).

2+ years in IT operations/cybersecurity with experience in a regulated or safety-critical setting (airline/airport/ANSP/MRO preferred).

Demonstrable experience building or running an ISO 27001-aligned ISMS; policy, risk, audit, and incident-response depth.

Hands-on with Microsoft 365/Azure/AAD, networks, identity, endpoint management, and cloud security; practical familiarity with airline stacks (EFB/EFF, PSS/DCS, W&B;, crew/rostering, flight planning).

Clear understanding of EASA Part-IS obligations (ISMS, ISMM, occurrence reporting, oversight) and how they integrate with AOC Management System & SMS in Malta (TM-CAD).

Certifications (nice to have): ISO/IEC 27001 Lead Implementer/Lead Auditor, CISM/CISSP, ITIL 4; cloud security certs.

Strong stakeholder skills across Accountable Manager, Nominated Persons (FO/GO/CA), Safety, Compliance Monitoring, OCC, Stations, and external providers.

Success measures (first 12 months)

ISMM approved and ISMS operating effectively; authority oversight results with timely closure of any findings.

EFB security fully implemented (device baseline, signed content, rapid revocation) and proven in exercises.

OCC/flight-critical BCP tested with agreed RTO/RPO; restoration drills completed and documented.

Supplier security baselined for 100% of PSS/DCS, ground handling, and MRO/CAMO interfaces; remediation plans tracked.

Training & culture: >95% completion for assigned roles; phishing and response metrics show measurable improvement.

What We Offer

Competitive salary & bonus; private health cover; training budget (incl. ISO 27001/Part-IS).

Travel benefits per policy; modern tooling; opportunity to shape airline-grade resilience and safety.

#J-18808-Ljbffr

📌 IT & Information Security Manager (AOC Operator Part-IS) FILLED (Ontario)
🏢 Air Vitosha
📍 Ontario