Vice President of Cybersecurity & Chief Information Security Officer (CISO)

AeroVironment•Simi Valley, CA

2d•$245,500 - $393,000•Hybrid

About The Position

The “Vice President of Cybersecurity & Chief Information Security Officer (CISO)” is a senior executive responsible for establishing, implementing, and maintaining AV’s enterprise vision, strategy, and cybersecurity program to ensure the confidentiality, integrity, and availability of the organization’s information assets and technology resources. The CISO provides strategic leadership for the organization’s cybersecurity function in support of both classified and unclassified defense programs. This role is responsible for ensuring compliance with Department of Defense (DoD) cybersecurity requirements, advancing the organization’s Cybersecurity Maturity Model Certification (CMMC) posture, implementing and maintaining alignment with National Institute of Standards and Technology (NIST) frameworks, and ensuring adherence to applicable federal laws, regulations, and contractual obligations. Additionally, the CISO will develop and execute cybersecurity strategies that support AV’s accelerated growth, acquisition, and integration initiatives. Reporting to the Chief Information Officer (CIO), the CISO serves as the principal advisor to executive leadership and the Board of Directors on all matters related to cybersecurity, information security governance, cyber risk management, and the protection of Controlled Unclassified Information (CUI), classified national security information, and other sensitive organizational assets.

Requirements

Bachelor’s degree in computer science, Information Security, Cybersecurity, Engineering, or related technical field required
Minimum 15 years of progressive experience in information security, with at least 10 years in senior leadership roles
Extensive experience in defense contracting environment with classified programs
Proven track record implementing and maintaining DoD cybersecurity compliance programs (NIST 800-171, CMMC, RMF)
Demonstrated experience managing enterprise-wide security programs in complex, multi-site organizations
Experience leading organizations through CMMC certification and FedRAMP authorization processes
Strong background in both physical and cyber security operations
Active Top Secret/SCI security clearance required
CISSP (Certified Information Systems Security Professional)
One or more of the following: CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), CRISC (Certified in Risk and Information Systems Control)
Deep understanding of NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-171
Expertise in CMMC 2.0 requirements and assessment processes
Knowledge of DoD Cloud Computing Security Requirements Guide (SRG) and FedRAMP
Understanding of DFARS, FAR, ITAR, EAR, and related defense contracting regulations
Proficiency with security technologies: SIEM, EDR/XDR, IAM, PAM, DLP, CASB, firewall/IDS/IPS
Understanding of secure software development practices and DevSecOps methodologies
Knowledge of zero trust architecture principles and implementation
Familiarity with classified network operations and cross-domain solutions
Strategic thinking with ability to translate security requirements into business enablement
Executive presence with proven ability to communicate complex security concepts to technical and non-technical audiences
Strong risk management and decision-making capabilities under pressure
Proven ability to influence and build consensus across organizational boundaries
Experience managing and developing diverse, geographically distributed teams
Budget management and financial acumen
U.S. Citizenship Required.

Nice To Haves

Master's degree in related fields is strongly preferred
Eligibility for Special Access Programs (SAP) preferred
GSLC (GIAC Security Leadership Certification)
CCSP (Certified Cloud Security Professional)
CGEIT (Certified in the Governance of Enterprise IT)
CAP (Certified Authorization Professional)
CMMC-AB Certified Professional or Provisional Assessor

Responsibilities

Develop and implement comprehensive cybersecurity strategy aligned with business objectives and national security requirements
Establish and maintain information security governance framework, policies, standards, and procedures
Serve as primary liaison with government customers, Defense Contract Management Agency (DCMA), Defense Counterintelligence and Security Agency (DCSA), and other regulatory bodies
Provide regular briefings to the Board of Directors, CEO, and executive leadership on security posture, risks, and initiatives
Lead enterprise risk management activities related to cybersecurity and information protection
Oversee cybersecurity budget planning, resource allocation, and investment prioritization
Ensure organizational compliance with NIST SP 800-171, CMMC 2.0, DFARS, ITAR, and other applicable regulations
Lead and maintain Cybersecurity Maturity Model Certification (CMMC) readiness and certification efforts
Manage System Security Plan (SSP) development, Plan of Action & Milestones (POA&M), and continuous monitoring programs
Oversee NIST 800-53 control implementation for classified systems and Risk Management Framework (RMF) authorization processes
Coordinate with Defense Industrial Base (DIB) Cybersecurity Program requirements
Develop and execute insider threat detection and prevention programs
Lead international cybersecurity compliance strategy, ensuring adherence to UK MoD DEFCON 658 / Def Stan 05-138, Cyber Essentials Plus, UK/EU GDPR, and applicable international data privacy and sovereignty regulations.
Establish cross-border data transfer controls and security architectures supporting NATO, AUKUS, and Five Eyes allied defense initiatives.
Direct enterprise security operations including Security Operations Center (SOC), incident response, and threat intelligence
Oversee implementation and management of security technologies including SIEM, EDR, DLP, IAM, and encryption solutions
Ensure secure system development lifecycle practices and DevSecOps integration
Manage vulnerability management, penetration testing, and security assessment programs
Direct cloud security architecture and controls for classified and unclassified environments
Oversee identity and access management programs including privileged access management
Oversee cybersecurity governance for Special Access Programs (SAP/SAR), SCIF network operations, COMSEC, and TEMPEST compliance in coordination with Government Security/OPSEC teams.
Lead cyber incident response planning, coordination, and execution
Ensure timely reporting of cyber incidents to DoD, FBI, and other required agencies per DFARS 252.204-7012
Coordinate with legal, CIO along with executive teams during security incidents
Oversee business continuity and disaster recovery planning for critical security systems
Manage relationships with external incident response partners and forensic specialists
Establish and enforce third-party risk management and vendor security assessment programs
Oversee supply chain security controls and acquisition security requirements
Ensure subcontractor cybersecurity compliance flows down through contracts
Manage security requirements for cloud service providers and managed service providers
Build, lead, and mentor high-performing information security and cybersecurity teams
Establish organizational structure spanning cybersecurity operations, governance/risk/compliance, security architecture, and program security
Foster culture of security awareness and accountability throughout the organization
Implement and maintain security education, training, and awareness programs for all personnel
Develop succession planning and talent development strategies for security organization