Cybersecurity Engineer Level 7

SALARY RANGE

$145,145 - $191,594

DEPT/DIV

Information Technology

SUPERVISOR

CyberSecurityOffice Manager OT Infra Safety

LOCATION

2 Broadway, New York, NY 10004

HOURS OF WORK

9:00 am - 5:30 pm (7.5 hours/day) or as required

This position is eligible for teleworking, which is currently one day per week. New hires are eligible to apply 30 days after their effective date of hire.

Opening

The Metropolitan Transportation Authority is North America's largest transportation network, serving a population of 15.3 million people across a 5,000-square-mile travel area surrounding New York City, Long Island, southeastern New York State, and Connecticut. The MTA network comprises the nation’s largest bus fleet and more subway and commuter rail cars than all other U.S. transit systems combined. MTA strives to provide a safe and reliable commute, excellent customer service, and rewarding opportunities.

Job Summary

The purpose of this position is to provide technical expertise in managing and analyzing cybersecurity risks.Cybersecurity Engineer will be responsible for design, building and maintaining infrastructure, applicationstechnology to support a secure cybersecurity posture. These include systems that support cybersecurity directlyand/or the business operations for Information and Operational Technology disciplines. Secure building andconfiguration of systems (applications, infrastructure, wireless, carrier systems, cloud,operational technology,IOT, etc.) from the outset reduces risk to MTA.

Specialized and focused skillets in various technology domainsassist with the overall risk reduction for the MTA. The configuration, hardening, guidance, response, and analysisof these systems aide in reduction and containment of Cyber Security risk. Risk assessments, data analyticstools, operational process reviews, and collaboration with security engineers, architects, developers, vendors,business units to constantly improve the overall security of the MTA The position will have seven (7) levels(including an internship level) which will require a combination of progressive experience, accomplishments,responsibilities, and/or education and may perform all or some of the responsibilities listed below depending onlevel.

Responsibilities

Researching emerging threats and vulnerabilities to aid in the identification of network incidents, andsupport the creation of new architecture, policies, standards, and guidance to address them

Knowledge and practical implementation of secure system configuration and hardening standards

Design, configure, and integrate secure solutions in the technology domains assigned

Provide incident response support, including mitigating actions to contain activity and facilitatingforensics analysis, system hardening, and recovery when necessary

Provides installation, system configuration, hardening and optimization for infrastructure, application,and security components and systems such as servers, workstations, mobile devices, directory services,operating systems, middleware, IOT, web and next generation firewalls, machine and human behaviorlearning tools, host-based security system, security event and incident monitoring systems, virtual,physical, and cloud platforms.

Identifies configuration gaps independently and/or with vendors to reduce cybersecurity risks

Reviews alerts and data from sensors and documents formal, technical incident reports

Tests new systems and manage cybersecurity risks and remediation system testing, baseline, and bestpractices

Responds to computer security incidents according to the computer security incident response policy andprocedures

Provides technical guidance to first responders for handling information security incidents

Provides timely and relevant updates to appropriate stakeholders and decision makers

Communicates investigation findings to relevant business units to help improve the information securityposture

Validates and maintains incident response plans and processes to address potential threats

Compiles and analyzes data for management reporting and metrics

Monitors relevant information sources to stay up to date on current attacks and trends

Analyzes potential impact of new threats and communicates risks back to detection analyst, architect,technology SME, and management functions

Performs root-cause analysis to document findings, and participates in root-cause elimination activities asrequired

Uses judgment to form conclusions that may challenge conventional wisdom

Hypothesizes new threats and indicators of compromise

Monitors threat intelligence feeds to identify a range of threats, including indicators of compromise andadvanced persistent threats (APTs)

Identifies the tactics, techniques and procedures (TTPs) of potential threats through the MITRE ATT&CKor similar frameworks

Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines,and procedures) under the direction of the IT Security Manager, where appropriate.

Performs other duties as assigned

Complies with all policies and standards

May be required to work hours outside regular work hours, as applicable

Observes the work performed by contractors, as applicable

Reviews invoices and approves them if the work has contractual standards, as applicable

Addresses performance issues with the contractor when possible, as applicable

Escalates issues to other parties when needed, as applicable

Qualifications

Bachelor’s Degree in Arts/Sciences (BA/BS). Combination of education and experience may be consideredin lieu of a degree

Minimum 10 years of relevant technology-based or cybersecurity experience or experience in a specificcybersecurity subdomain (Cloud, Applications, Infrastructure, Security Technology, etc.).

Minimum 5 years. Must possess at least two of the following professional certifications in the subject domain,including but not limited to: Certified Information Security Professional (CISSP), Global InformationAssurance Certification (GIAC), Certified Information Security Manager (CISM), Certified in Riskand Information Systems Control (CRISC), or Certified Information Systems Auditor (CISA), or otherrelated certification(s)

Required Knowledge, Skills, and Abilities

Researching emerging threats and vulnerabilities to aid in the identification ofnetwork incidents, and supports the creation of new architecture, policies, standards, and guidance toaddress them

Knowledge and practical implementation of secure system configuration and hardeningstandards

Design, configure and integrated secure solutions in the technology domains assigned

Provideincident response support, including mitigating actions to contain activity and facilitating forensicsanalysis, system hardening and recovery when necessary

Provides installation, system configuration,hardening and optimization for infrastructure, application, and security components and systems such asservers, workstations, mobile devices, directory services, operating systems, middleware, IOT, web andnext generation firewalls, machine and human behavior learning tools, host-based security system,security event and incident monitoring systems, virtual, physical, and cloud platforms.

Identifiesconfiguration gaps independently and/or with vendors to reduce cybersecurity risks

Reviews alerts anddata from sensors and documents formal, technical incident reports

Tests new systems and managecybersecurity risks and remediation system testing, baseline, and best practices

Responds to computersecurity incidents according to the computer security incident response policy and procedures

Providestechnical guidance to first responders for handling information security incidents

Provides timely andrelevant updates to appropriate stakeholders and decision makers

Communicates investigation findingsto relevant business units to help improve the information security posture

Validates and maintainsincident response plans and processes to address potential threats

Compiles and analyzes data formanagement reporting and metrics

Monitors relevant information sources to stay up to date on currentattacks and trends

Analyzes potential impact of new threats and communicates risks back to detectionanalyst, architect, technology SME, and management functions Performs root-cause analysis todocument findings, and participate in root-cause elimination activities as required

Uses judgment to formconclusions that may challenge conventional wisdom

Hypothesizes new threats and indicators ofcompromise

Monitors threat intelligence feeds to identify a range of threats, including indicators ofcompromise and advanced persistent threats (APTs)

Identifies the tactics, techniques and procedures(TTPs) of potential threats through the MITRE ATT&CK or similar frameworks

Participate in the creationof enterprise security documents (policies, standards, baselines, guidelines, and procedures) under thedirection of the IT Security Manager, where appropriate.

The role will provide a proactive approach tocybersecurity while also performing investigation of security incidents related to MTA operations relatedto Cyber Security.

Acts as a technical resource for multiple technologies, with vast knowledge of thecapabilities and constraints of technologies supported to continually improve system effectiveness andefficiency.

Demonstrates a strong understanding of the current and future technology architecture,including the interoperability of technologies to effectively integrate MTA systems and support the long-term strategies of the business.

Provides guidance and training to the IT community to maximize andshare learning.

Analyzes cross-technology/platform issues and addresses problems factoring in anunderstanding of the current and future architectures to ensure optimal performance and reliabilityacross systems.

Leads the evaluation of new technologies relative to their domain(s) to determineapplicability to and best meet the needs of MTA and constituent agencies.

Proposes technologyinvestments supported by a thorough technical analysis and business case.

Develops disaster recoveryand contingency plans for their domain(s) to provide users with minimal interruptions in service.

Createscomplete RFPs and RFIs and negotiates contract terms and conditions with vendors and procurement inconsideration of the needs of the business.

Interacts with major providers at the technical expert level toaddress mission critical issues, evaluates ongoing vendor service level and enforces SLAs and penalties.

Establishes systems to monitor compliance with architectural standards and to ensure technical integrity.

Significant practical expertise in cybersecurity-related disciplines

Requires seasoned expertise in multiplesecurity domains, technologies and strong understanding of the current and future technology andsecurity architecture, including the inter-operability of security solutions and technologies.

Requires proven track record of successful implementation of architectural designs.

Requires proven track recordin configuration and hardening of systems

Expert ability to conduct and analyze a security riskassessment

Expert understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologiesrequired (OSI Layers 5-7).

Some scripting or programming skills (PERL, Python, PowerShell,etc.) preferred as needed

Critical Skills

Serves as a multi-technology technical authority with expert knowledge of OT,security architecture, and cross-system interoperability. • Shapes long-term technology strategy,ensuring secure integration of enterprise and operational systems.

Provides specialized guidance,mentorship, and training across the IT and OT security community.

Evaluates emerging technologies,identifying applicability, operational risks, and strategic impact; develops technical business cases forinvestment.

Develops domain specific disaster recovery and resilience strategies to minimize serviceinterruptions.

Authors comprehensive technical procurement documents (RFPs/RFIs) and leadscontract discussions with vendors and procurement teams. • Engages at the expert level with majorservice providers, manages mission critical issues, and enforces technical service level commitments.

Establishes compliance monitoring systems to ensure alignment with architectural standards and securitybest practices.

Oversees project performance, reviews deliverables, and escalates issues asappropriate.

Competencies

Core Competency

Proficiency Level

Competency Definition

Technical Skills

Expert

Specialized knowledge and expertise on tools, programs, domains, platforms, and products used for specific tasks

Tech Savvy

Expert

Anticipating and adopting innovations in business-building digital and technology applications

Communicates Effectively

Expert

Developing and delivering multi-mode communications that convey a clear understanding of the unique needs of different audiences

Values Diversity

Expert

Recognizing the value that different perspectives and culters bring to an organization

Collaborates

Expert

Building partnerships and working collaboratively with othersto meet shared objectives

Customer Focus

Advanced

Building strong customer relationships and deliveringcustomer-centric solutions

Cultivates Innovation

Advanced

Creating new and better ways for the organization to besuccessful

Other Information

Pursuant to the New York State Public Officers Law & the MTA Code of Ethics, all employees who hold a policymaking position must file an Annual Statement of Financial Disclosure (FDS) with the NYS Commission on Ethics and Lobbying in Government (the “Commission”).

Equal Employment Opportunity

MTA and its subsidiary and affiliated agencies are Equal Opportunity Employers, including with respect to veteran status and individuals with disabilities.

The MTA encourages qualified applicants from diverse backgrounds, experiences, and abilities, including military service members, to apply.