Ransomware Recovery Command Leader — Aviation Services

The mandate

Ransomware encrypted identity, crew scheduling and maintenance-document services, forcing manual continuity and grounding decisions across two operating bases. Backup status reports show successful jobs but not clean restore points, and emergency accounts created during outage are not fully reconciled. The security executive exited after restored systems were reconnected without consistent forensic clearance, data-integrity comparison or business-owner acceptance.

The leader must start within seven days for ten months, initially onsite continuously and later following the stated regional cadence. Daily recovery command remains in force until crew and maintenance services pass operating-owner gates, then moves to twice-weekly resilience governance. Permanent recruitment begins after critical restoration; five weeks of overlap follow, with extension possible only if the appointed successor's notice crosses the authorised end date.

Handover requires eradication assurance, reconciled identities, clean restoration tiers, completed regulatory and insurer evidence, two enterprise recovery exercises and successor ownership of residual risk. Temporary accounts and bypasses must be closed, backup immutability must survive a destructive test and each aviation service must own its manual-to-digital reconciliation. System availability without source comparison, access control and data integrity does not count.

The interim may isolate systems, halt reconnection, commission response support and sequence recovery within AED 20 million. The leader can reject a restored image, require fresh credential issuance and pause a supplier connection when provenance is incomplete. Ransom payment, public attribution, aircraft dispatch, permanent hiring and expenditure beyond delegation remain board or accountable-officer decisions, with those boundaries logged during crisis meetings.

Aircraft technical investigation, commercial schedule redesign and general infrastructure modernisation are excluded. Safety and operations executives determine whether services support dispatch, while legal determines notification and privilege. The assignment governs cyber trust and operational recovery, recording dependencies without becoming the owner of aviation safety or the long-term technology roadmap.

Why this seat is open

Unsafe reconnection decisions destroyed confidence in incident leadership. Aviation teams need one cyber command that respects safety authority. The board wants an experienced executive until recovery evidence and permanent succession are complete.

What you will own

• Establish a defensible intrusion, encryption, restoration and executive-decision chronology linked to preserved forensic and operational evidence.
• Define recovery tiers using aviation safety, operational dependency, data integrity, identity readiness and verified clean-platform availability.
• Decide which identities, networks and applications remain isolated or reconnect.
• Reconcile restored data against authoritative crew, operational and maintenance records before each service owner signs acceptance.
• Coordinate insurer, counsel, regulator and law-enforcement evidence without confusing authority.
• Exercise identity loss and destructive reinfection across aviation continuity teams.
• Transfer recovery architecture, temporary-control closures, residual exposures and crisis records through two successor-chaired resilience forums.

Candidate qualifications

• Commanded enterprise ransomware recovery in aviation or another safety-critical operator with prolonged manual continuity.
• Can evidence decisions withholding reconnection until forensic, credential, backup-provenance and business-integrity gates passed.
• Recovered identity, scheduling and regulated operational records in dependency order, including business-owner integrity reconciliation.
• Worked with insurers, counsel, regulators and law enforcement during a live extortion and recovery decision cycle.
• Integrated cyber recovery with safety-led business continuity, manual operations and regulated service restoration.
• Handed residual risk, temporary access, insurer commitments and recovery governance to permanent executive ownership.

Non-negotiables

• Available in Dubai within seven days for incident-intensity working.
• Independent of response, insurer and recovery vendors engaged.
• Will not authorise ransom or aircraft-operating decisions.
• Has executive recovery command, not advisory-only incident experience.

1. 49 words maximum. State your availability and the largest ransomware recovery you personally commanded.
2. 49 words maximum. Which integrity check caused you to delay reconnection of a critical service?
3. 49 words maximum. Describe how you separated cyber authority from safety or operational command.