Director of Compliance

Title: Director of Compliance Company: Heven AeroTech Location: FLSA: Exempt Reports To: Chief of Staff

About Our Company: At Heven AeroTech (Heven), we don’t just believe in the power of people—we build our success on it. As a recognized leader in hydrogen-powered drones, we’ve earned recognition for creating a workplace where innovation thrives, collaboration is second nature, and every employee feels valued. Our culture is anchored in trust and a shared commitment to excellence.

We believe great teams are built on individuals who are humble, hungry, and smart —those who put team success first, take initiative to continuously improve, and demonstrate strong interpersonal awareness. At Heven, your voice matters, your ideas are heard, and your contributions make a tangible impact as you grow through hands-on experience and collaboration across the team.

Role Summary: The Director of Compliance leads Heven AeroTech’s enterprise-wide compliance program, ensuring adherence to federal export control laws (ITAR/EAR), industrial security requirements (NISPOM), cybersecurity mandates (CMMC/NIST 800-171), ethics obligations, occupational safety regulations, and employee benefits laws. Operating at the intersection of legal obligation and operational execution, this role directly supervises the Safety Manager and IT Administrator, advises executive leadership on regulatory risk, and fosters a culture of compliance and ethical conduct throughout the defense industrial base.

Essential Responsibilities:

Export Controls — ITAR / EAR Compliance Oversight

• Provide strategic oversight of Heven AeroTech’s export compliance obligations under the International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR), whether administered through a qualified internal Empowered Official (EO) or a contracted external compliance resource.
• Ensure the designation, performance management, and accountability of the Empowered Official function; serve directly as EO or manage the engagement of an external ITAR/EAR compliance consultant or law firm as operationally appropriate.
• Oversee the development, maintenance, and continuous improvement of the Technology Control Plan (TCP) and Export Management and Compliance Program (EMCP).
• Provide executive-level review and approval authority over export license applications, Technical Assistance Agreements (TAAs), Manufacturing License Agreements (MLAs), and commodity classifications (USML/CCL).
• Ensure execution of export control audits, restricted party screening, and voluntary disclosure management to DDTC and BIS; maintain accountability for timely and accurate reporting.
• Ensure export control training programs meet regulatory requirements under 22 C.F.R. Part 122 and 15 C.F.R. Part 762, whether delivered internally or through an external provider.

Facility Security Officer (FSO) / Industrial Security

• Serve as or directly supervise the Facility Security Officer (FSO), ensuring compliance with the National Industrial Security Program Operating Manual (NISPOM) / 32 C.F.R. Part 117.
• Manage personnel security clearance processes including investigations, visit authorizations, and incident reporting through DISS and related government systems.
• Maintain and administer the facility’s Standard Practice and Procedure (SPP) and ensure full Insider Threat Program compliance.
• Interface with the Defense Counterintelligence and Security Agency (DCSA) for facility inspections, program reviews, and adverse information reporting.
• Oversee classified storage, document control, secure communication requirements, and SCI/SAP access where applicable.

Information Security (InfoSec) / Cybersecurity Compliance

• Lead compliance with Cybersecurity Maturity Model Certification (CMMC), NIST SP 800-171, and DFARS [phone removed] for the protection of Controlled Unclassified Information (CUI).
• Oversee the development and maintenance of the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and incident response procedures.
• Directly supervise the IT Administrator; provide strategic direction and oversight of IT operations to ensure information systems, networks, and cloud environments meet CMMC, NIST SP 800-171, and applicable cybersecurity compliance requirements.
• Manage cybersecurity incident reporting obligations to the DoD and relevant program offices within required timelines.
• Support CMMC third-party assessment organization (C3PAO) assessments and maintain certification documentation.

Ethics & Business Conduct

• Administer Heven AeroTech’s Code of Business Ethics and Conduct and ensure compliance with FAR 52.203-13 (Contractor Code of Business Ethics and Conduct).
• Manage the ethics hotline and reporting system; investigate potential violations and coordinate with HR, Legal, and management on corrective actions and disciplinary outcomes.
• Design and deliver ethics training programs and awareness campaigns across all employee levels.
• Prepare and submit timely disclosures to the Government for violations of federal criminal law and the False Claims Act as required.
• Chair or support the company’s Ethics & Compliance Committee; report to the Board Audit Committee or designated executive officer as required.

Environmental, Health & Safety (EHS) Compliance

• Provide compliance oversight for occupational health and safety obligations under OSHA 29 C.F.R. Part 1910 and applicable state regulations within an aerospace manufacturing environment.
• Ensure regulatory compliance related to hazardous materials handling, chemical hygiene plans, and process safety requirements where applicable.
• Oversee OSHA recordkeeping and reporting (300/301 logs), incident investigation processes, and interface with OSHA inspectors and regulatory authorities.
• Directly supervise the Safety Manager; provide leadership, performance oversight, and development guidance while ensuring EHS program activities align with company compliance objectives and regulatory requirements.
• Monitor EPA and environmental compliance obligations related to manufacturing operations, including waste disposal, air emissions, and stormwater management.

HIPAA & Benefits Compliance

• Ensure the company’s health plan and benefits administration practices comply with HIPAA Privacy and Security Rules, including Business Associate Agreement (BAA) oversight.
• Oversee ERISA compliance for welfare benefit plans and coordinate with benefits counsel and third-party administrators on regulatory filings (Form 5500, SPDs, SARs).
• Monitor ACA employ