Patria is a key industrial partner in the programme in which Finland is acquiring 64 F-35 fighter jets from the American company Lockheed Martin. The collaboration requires that Patria’s information systems’ cybersecurity and risk management comply with the strict regulations of the U.S. government.

Ensuring this is the responsibility of Patria’s Information Systems Security Officer, Jean Heffner. She makes sure that cybersecurity is not just on paper but also works in daily operations.

Jean says that her job is a combination of oversight, coordination, documentation, and risk management.
– My role at Patria is to act as an independent specialist who continuously audits compliance with cybersecurity requirements. I ensure, for example, that the configuration and monitoring of information systems are properly arranged to protect data.

Cybersecurity meets U.S. requirements

The most important task for Jean Heffner has been building processes related to compliance for the F-35 programme. To begin receiving sensitive information, Patria’s networks and operating models require approval from the U.S. Department of Defense.

Jean works closely with colleagues responsible for Patria’s information systems and cybersecurity. Training is a central part of her work.
– We go through with Patria’s personnel what is considered sensitive information by the United States and how it should be handled.

Jean reports her audits to the U.S. government. Her contact person in the U.S. administration is the Information System Security Manager, with whom she has ongoing discussions.
– This way, we ensure that, for example, changes made to Patria’s information systems meet all requirements.

 

I was elected to provide my expertise to Patria, having accumulated more than twenty years of experience in ensuring compliance with cybersecurity and risk management requirements.

Long experience in ensuring cybersecurity

Jean’s mother’s family is from Finland, so the country is familiar to her. She read about Patria’s participation in the F-35 project in a newspaper article that her Finnish cousin sent to her.

Jean decided to offer her expertise to Patria, having accumulated more than twenty years of experience in ensuring compliance with cybersecurity and risk management requirements. She has served, among other roles, as a consultant for projects commissioned by the United States Department of Defence.
– From my own experience, I understood how the processes function and what cybersecurity and risk management requirements Patria needs to fulfil for the United States.

A central aspect of Jean’s work is to act as a bridge between Finnish and American working cultures.
– Both cultures are good and effective, but they differ vastly. My responsibility is to serve as a kind of mediator, ensuring Finns and Americans understand each other and matters can be harmonised.

It is important to consider, for example, that the resources available in Finland are smaller than those in the United States. Employees who fully meet all competency requirements may not always be readily available on the labour market; instead, they must be trained for their positions.

Jean notes there are also differences in decision-making processes. In the United States, there are more tiers of administration, yet decisions are made swiftly. In Finland, organisational hierarchies are flatter.
– Making decisions takes more time in Finland, as teams engage in discussions and seek solutions based on consensus.

Jean has lived in Finland for two years and, in her spare time, has travelled throughout the country. The most memorable place for her has been her mother’s family farm in Northern Ostrobothnia, which is still cultivated by the family.
– I am also fond of hiking, and Finland offers plenty of excellent places for that.

Text: Matti Remes

Read more stories