Cybersecurity Engineer Levels 4 - 7

JOB TITLE

Cybersecurity Engineer Levels 4- 7

SALARY RANGE

Level 4:$102,760 - $139,755

Level 5:$117,973 - $158,343

Level 6: $124,311 - $169,104

Level 7: $140,917 - $186,014

DEPT/DIV

Information Technology

SUPERVISOR

Cybersecurity Office Manager OT Infra Safety

LOCATION

2 Broadway, New York, NY 10004

HOURS OF WORK

9:00 am - 5:30 pm (7.5 hours/day) or as required

This position is eligible for teleworking, which is currently one day per week. New hires are eligible to apply 30 days after their effective date of hire.

Opening

The Metropolitan Transportation Authority is North America's largest transportation network, serving a population of 15.3 million people across a 5,000-square-mile travel area surrounding New York City, Long Island, southeastern New York State, and Connecticut. The MTA network comprises the nation’s largest bus fleet and more subway and commuter rail cars than all other U.S. transit systems combined. MTA strives to provide a safe and reliable commute, excellent customer service, and rewarding opportunities.

Job Summary

The purpose of this position is to provide technical expertise in managing and analyzing cybersecurity risks.Cybersecurity Engineer will be responsible for design, building and maintaining infrastructure, applicationstechnology to support a secure cybersecurity posture. These include systems that support cybersecurity directlyand/or the business operations for Information and Operational Technology disciplines. Secure building andconfiguration of systems (applications, infrastructure, wireless, carrier systems, cloud,operational technology,IOT, etc.) from the outset reduces risk to MTA.

Specialized and focused skills in various technology domainsassist with the overall risk reduction for the MTA. The configuration, hardening, guidance, response, and analysisof these systems aide in the reduction and containment of cybersecurity risk. Risk assessments, data analyticstools, operational process reviews, and collaboration with security engineers, architects, developers, vendors, and business units to constantly improve the overall security of the MTA.

The position will have seven (7) levels(including an internship level) which will require a combination of progressive experience, accomplishments,responsibilities, and/or education and may perform all or some of the responsibilities listed below depending onlevel.

Required Critical Skills

Level 5

• Practical experience configuring and securing enterprise-grade network switches, applying segmentation, access control policies, and secure network architectures.
• Hands-on experience with network-based threat detection and anomaly monitoring platforms, including tuning alerts and validating detections.
• Ability to deploy, operate, and interpret OT focused passive monitoring technologies and industrial protocol visibility tools.
• Strong understanding of cybersecurity fundamentals, including authentication, zoning, encryption, and intrusion detection across mixed IT/OT environments.
• Supports vulnerability identification, secure configuration, and risk-based mitigation activities for OT assets.
• Capable of coordinating across operations, engineering, and IT teams to ensure security controls align with reliability and safety goals.

Preferred/additional skills

• Experience applying cybersecurity frameworks to OT environments.
• Strong diagnostic skills for complex network and security issues.
• Exposure to OT incident response and recovery workflows.

Preferred certifications

Mid-level cybersecurity or network security credentials

Cisco Certifications Preferred

OT/ICS focused certifications are a plus.

Level 6

• Retains and expands upon all duties and qualifications from prior levels.
• Deep expertise in OT cybersecurity, including secure architecture design, system hardening, and industrial risk modeling.
• Experience leading risk-based vulnerability and patch programs for OT systems, prioritizing remediation based on impact and exploitability.
• Ability to integrate secure solutions across hybrid infrastructures, including cloud-supported monitoring, industrial networks, and control system environments.
• Strong cross-functional communication skills bridging IT security, OT engineering, and operations leadership.
• Demonstrated capability managing complex security projects and coordinating multi-team initiatives.
• Proficiency in analyzing threat behaviors and applying structured cybersecurity models to improve detection and defense.
• Supports incident response with forensic analysis, containment guidance, and operational recovery planning.

Preferred/additional skills

Experience working across diverse industrial or transportation environments.

Advanced analytical and root cause capabilities for cyber-physical incidents.

Preferred certifications

• Senior-level cybersecurity certifications (such as CISSP-level equivalents).
• Advanced degrees in cybersecurity, engineering, or related fields.
• Additional OT focused or incident response credentials preferred.

Level 7

• Retains and expands upon all duties and qualifications from prior levels.
• Serves as a multi-technology technical authority with expert knowledge of OT, security architecture, and cross-system interoperability.
• Shapes long-term technology strategy, ensuring secure integration of enterprise and operational systems.
• Provides specialized guidance, mentorship, and training across the IT and OT security community.
• Evaluates emerging technologies, identifying applicability, operational risks, and strategic impact; develops technical business cases for investment.
• Develops domain-specific disaster recovery and resilience strategies to minimize service interruptions.
• Authors comprehensive technical procurement documents (RFPs/RFIs) and leads contract discussions with vendors and procurement teams.
• Engages at the expert level with major service providers, manages mission-critical issues, and enforces technical service level commitments.
• Establishes compliance monitoring systems to ensure alignment with architectural standards and security best practices.
• Oversees project performance, reviews deliverables, and escalates issues as appropriate.

Responsibilities

Research emerging threats and vulnerabilities to aid in the identification of network incidents, andsupport the creation of new architecture, policies, standards, and guidance to address them

Knowledge and practical implementation of secure system configuration and hardening standards

Design, configure, and integrate secure solutions in the technology domains assigned

Provide incident response support, including mitigating actions to contain activity and facilitatingforensics analysis, system hardening, and recovery when necessary

Provides installation, system configuration, hardening, and optimization for infrastructure, application,and security components and systems such as servers, workstations, mobile devices, directory services,operating systems, middleware, IOT, web and next-generation firewalls, machine and human behaviorlearning tools, host-based security systems, security event and incident monitoring systems, virtual,physical, and cloud platforms.

Identifies configuration gaps independently and/or with vendors to reduce cybersecurity risks

Reviews alerts and data from sensors and documents formal, technical incident reports

Tests new systems and manages cybersecurity risks and remediation system testing, baseline, and bestpractices

Responds to computer security incidents according to the computer security incident response policy andprocedures

Provides technical guidance to first responders for handling information security incidents

Provides timely and relevant updates to appropriate stakeholders and decision makers

Communicates investigation findings to relevant business units to help improve the information securityposture

Validates and maintains incident response plans and processes to address potential threats

Compiles and analyzes data for management reporting and metrics

Monitors relevant information sources to stay up to date on current attacks and trends

Analyzes potential impact of new threats and communicates risks back to detection analyst, architect,technology SME, and management functions

Performs root-cause analysis to document findings, and participates in root-cause elimination activities asrequired

Uses judgment to form conclusions that may challenge conventional wisdom

Hypothesizes new threats and indicators of compromise

Monitors threat intelligence feeds to identify a range of threats, including indicators of compromise andadvanced persistent threats (APTs)

Identifies the tactics, techniques, and procedures (TTPs) of potential threats through the MITRE ATT&CKor similar frameworks

Participates in the creation of enterprise security documents (policies, standards, baselines, guidelines,and procedures) under the direction of the IT Security Manager, where appropriate.

The role will provide a proactive approach to cybersecurity while also performing investigation of security incidents related to MTA operations related to Cyber Security.

Accountabilities

Level 4

Executes the defined product lifecycle, manages the product lifecycle for a component of the infrastructure, proposes changes for implementation, gathers data and analyzes capacity and performance to assure operational availability.

Analyzes the current state of the infrastructure and identifies opportunities for improvement to ensure systems meet business needs. Contributes to changes to established roadmaps, documents them effectively, and executes the implementation of changes in their area(s) of responsibility.

Provides ongoing support and troubleshooting for installed technical solutions by analyzing a chain of events and applying technical knowledge, following established procedures and standards to resolve immediate customer needs.

Investigates, evaluates, and tests new products and technologies relevant to assigned infrastructure subsets to enhance cybersecurity analytics and overall security posture. Implements and/or supports the implementation of new technologies for their area of cybersecurity that affects infrastructure, applications, and/or processes.

Promotes security standards and supports efforts to expand and migrate to future security architecture to improve security and share learning.

Performs other duties and tasks as assigned.

Observing the work performed by the contractor.

Reviewing invoices and approving them if the work meets contractual standards.

Addressing performance issues with the contractor when possible.

Escalating issues to other parties as needed.

Level 5

Same as Level 4 but with the following additional accountabilities

Provides more advanced analytical capability in several security domains.

Adds new components to a roadmap, documents them effectively, and directs the testing and implementation of changes.

When provided with an objective to improve security in their security domain(s) and related technology, develops and implements action plans needed to effect the change.

Researches new technologies/products and their impact on the infrastructure, prepares a preliminary evaluation of technologies/products and associated costs, and develops and presents recommendations to support anticipated future business needs.

Receives security and performance data and analyzes the baselines and efficacy of installed technologies. Proposes and implements any required changes, including identifying and planning for any resulting impacts on other technologies to optimize system availability and continuity.

Provides ongoing support and troubleshooting for incidents, correlations, and reporting to more junior analysts to resolve immediate security threats and/or customer needs.

Provides technical leadership to project teams in their area of expertise and/or leads teams to complete projects specific to their area(s) of expertise to maximize and share learning.

Provides guidance and technical coaching to less experienced staff to support effective workflow and develop technical talent.

Performs other duties and tasks as assigned.

Observing the work performed by the contractor.

Reviewing invoices and approving them if the work meets contractual standards.

Addressing performance issues with the contractor when possible.

Escalating issues to other parties as needed.

Oversees rigorous quality assurance processes to deliver reliability, performance, and safety objectives

Oversees staff workload and quality of work, addressing performance issues when needed.

Level 6

• Same as Level 5 but with the following additional accountabilities
• Serves as a technical resource for multiple components of the security architecture, risk analysis, and analytics to help define the problems and identify remediation strategies for them.
• Troubleshoots and analyzes most problems within assigned area(s), providing cybersecurity correlation, expertise, and resolution that may be complicated by technology interdependency and challenging security issues
• Participates in planning for the future technical architecture, providing insight into the future of their area of technology in order to continually improve effectiveness and efficiency.
• Participates in or leads the development of roadmaps related to their area(s) of expertise to manage and meet identified technology needs.
• Participates in the evaluation of new technologies relative to their domain(s) to determine applicability to and best meet the needs of MTA and constituent agencies.
• Specifies the monitoring points to assess performance of technologies in their domain(s). Recommends the necessary actions to ensure optimal performance and reliability.
• Develops disaster recovery and contingency plans for their domain(s) to provide users with minimal interruptions in service.
• Provides technical leadership to project teams in their area of expertise to promote technical understanding and talent development and/or leads teams to complete projects when a project manager has not been assigned.
• Contributes to the technical elements of RFPs and RFIs and negotiates with vendors on technical issues to ensure results are delivered in line with user and organization requirements.
• Interacts with major providers at the technical expert level to address mission-critical issues, evaluates ongoing vendor service level, and enforces SLAs and penalties.
• Performs other duties and tasks as assigned.
• Observing the work performed by the contractor.
• Reviewing invoices and approving them if the work meets contractual standards.
• Addressing performance issues with the contractor when possible.
• Escalating issues to other parties as needed.

Level 7

• Same as Level 6 but with the following additional accountabilities
• Acts as a technical resource for multiple technologies, with vast knowledge of the capabilities and constraints of technologies supported to continually improve system effectiveness and efficiency.
• Demonstrates a strong understanding of the current and future technology architecture, including the interoperability of technologies to effectively integrate MTA systems and support the long-term strategies of the business.
• Provides guidance and training to the IT community to maximize and share learning.
• Analyzes cross-technology/platform issues and addresses problems factoring in an understanding of the current and future architectures to ensure optimal performance and reliability across systems.
• Leads the evaluation of new technologies relative to their domain(s) to determine applicability to and best meet the needs of MTA and constituent agencies.
• Proposes technology investments supported by a thorough technical analysis and business case.
• Develops disaster recovery and contingency plans for their domain(s) to provide users with minimal interruptions in service.
• Creates complete RFPs and RFIs and negotiates contract terms and conditions with vendors and procurement in consideration of the needs of the business.
• Interacts with major providers at the technical expert level to address mission-critical issues, evaluates ongoing vendor service levels, and enforces SLAs and penalties.
• Establishes systems to monitor compliance with architectural standards and to ensure technical integrity.
• Performs other duties and tasks as assigned.
• Observing the work performed by the contractor.
• Reviewing invoices and approving them if the work meets contractual standards.
• Addressing performance issues with the contractor when possible.
• Escalating issues to other parties as needed.

Qualifications

Level 4

• Bachelor’s Degree and a minimum of 3 years of relevant experience. An equivalent combination of education and experience may be considered in lieu of a degree.
• Bachelor’s degree in Computer Science or related fields preferred.
• Current CISSP or other advanced security-related certification preferred but not required.
• At least one certification in technology subdomains preferred but not required (ie., Cloud, Applications, Infrastructure, Security Technology, etc.)
• Proven ability to independently evaluate and resolve most problems within an area of infrastructure, applications within a security domain context.
• Proven ability to analyze and/or conduct a security risk assessment.
• Advanced understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologies required (OSI Layers 5-7) required.
• Some scripting or programming skills (PERL, Python, PowerShell, etc.) preferred as needed.

Level 5

Same as Level 4 but with the following additional qualifications

Bachelor’s Degree and minimum 5 years of relevant experience in a specific cybersecurity subdomain (Cloud, Applications, Infrastructure, Security Technology, etc.).

An equivalent combination of education and experience may be considered in lieu of a degree.

Must possess at least one of the following professional certifications in the subject domain, including but not limited to: Certified Information Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), or Certified Information Systems Auditor (CISA), or other related certification(s)

Bachelor’s degree in Computer Science or related fields preferred.

Progressive cybersecurity-related accomplishments.

Requires broad technical knowledge of multiple technologies, or an in-depth knowledge of one technology including its impact on other technologies.

Proven ability to analyze and/or conduct a security risk assessment.

Advanced understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologies required (OSI Layers 5-7) required.

Some scripting or programming skills (PERL, Python, PowerShell, etc.) preferred as needed.

Level 6

Same as Level 5 but with the following additional qualifications

Bachelor’s Degree and minimum 8 years of relevant experience in a specific cybersecurity subdomain (Cloud, Applications, Infrastructure, Security Technology, etc.)

An equivalent combination of education and experience may be considered in lieu of a degree.

Must possess at least one of the following professional certifications in the subject domain, including but not limited to: Certified Information Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or other related certification(s)

Bachelor’s degree in Computer Science or related fields preferred.

Verifiable implementation of security domain controls for enterprise technologies

Requires seasoned expertise in multiple technologies and strong understanding of the current and future technology architecture, including the interoperability of technologies.

Advanced ability to conduct and analyze a security risk assessment

Expert understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologies required (OSI Layers 5-7) required.

Some scripting or programming skills (PERL, Python, PowerShell, etc.) preferred as needed.

Level 7

Same as Level 6 but with the following additional qualifications

Bachelor’s Degree and minimum 10 years of relevant experience. An equivalent combination of education and experience may be considered in lieu of a degree.

10+ years of relevant technology-based or cybersecurity experience or experience in a specific cybersecurity subdomain (Cloud, Applications, Infrastructure, Security Technology, etc.).

Must possess at least two of the following professional certifications in the subject domain, including but not limited to: Certified Information Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or other related certification(s)

Significant practical expertise in cybersecurity-related disciplines

Requires seasoned expertise in multiple security domains, technologies, and a strong understanding of current and future technology and security architecture, including the interoperability of security solutions and technologies.

Requires a proven track record of successful implementation of architectural designs.

Requires a proven track record in configuration and hardening of systems

Expert ability to conduct and analyze a security risk assessment

Expert understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologies required (OSI Layers 5-7) required.

Some scripting or programming skills (PERL, Python, PowerShell, etc.) preferred as needed

Competencies

Level 4

Capable

Specialized knowledge and expertise on tools, programs, domains, platforms, and products used for specific tasks

Capable

Anticipating and adopting innovations in business-building digital and technology applications

Adept

Developing and delivering multi-mode communications that convey a clear understanding of the unique needs of different audiences

Adept

Recognizing the value that different perspectives and cultures bring to an organization

Adept

Building partnerships and working collaboratively with othersto meet shared objectives

Capable

Building strong customer relationships and deliveringcustomer-centric solutions

Capable

Creating new and better ways for the organization to besuccessful

Level 5

Core Competency

Proficiency Level

Competency Definition

Technical Skills

Adept

Specialized knowledge and expertise on tools, programs, domains, platforms, and products used for specific tasks

Tech Savvy

Adept

Anticipating and adopting innovations in business-building digital and technology applications

Communicates Effectively

Advanced

Developing and delivering multi-mode communications that convey a clear understanding of the unique needs of different audiences

Values Diversity

Advanced

Recognizing the value that different perspectives and cultures bring to an organization

Collaborates

Advanced

Building partnerships and working collaboratively with othersto meet shared objectives

Customer Focus

Adept

Building strong customer relationships and deliveringcustomer-centric solutions

Cultivates Innovation

Adept

Creating new and better ways for the organization to besuccessful

Level 6

Core Competency

Proficiency Level

Competency Definition

Technical Skills

Advanced

Specialized knowledge and expertise on tools, programs, domains, platforms, and products used for specific tasks

Tech Savvy

Advanced

Anticipating and adopting innovations in business-building digital and technology applications

Communicates Effectively

Expert

Developing and delivering multi-mode communications that convey a clear understanding of the unique needs of different audiences

Values Diversity

Advanced

Recognizing the value that different perspectives and cultures bring to an organization

Collaborates

Advanced

Building partnerships and working collaboratively with othersto meet shared objectives

Customer Focus

Adept

Building strong customer relationships and deliveringcustomer-centric solutions

Cultivates Innovation

Adept

Creating new and better ways for the organization to besuccessful

Level 7

Core Competency

Proficiency Level

Competency Definition

Technical Skills

Expert

Specialized knowledge and expertise on tools, programs, domains, platforms, and products used for specific tasks

Tech Savvy

Expert

Anticipating and adopting innovations in business-building digital and technology applications

Communicates Effectively

Expert

Developing and delivering multi-mode communications that convey a clear understanding of the unique needs of different audiences

Values Diversity

Expert

Recognizing the value that different perspectives and cultures bring to an organization

Collaborates

Expert

Building partnerships and working collaboratively with othersto meet shared objectives

Customer Focus

Advanced

Building strong customer relationships and deliveringcustomer-centric solutions

Cultivates Innovation

Advanced

Creating new and better ways for the organization to besuccessful

Other Information

May need to work outside of normal work hours supporting operations on a 24/7 basis

Travel may be required to other MTA locations or other external sites

Pursuant to the New York State Public Officers Law & the MTA Code of Ethics, all employees who hold a policymaking position must file an Annual Statement of Financial Disclosure (FDS) with the NYS Commission on Ethics and Lobbying in Government (the “Commission”).

Equal Employment Opportunity

MTA and its subsidiary and affiliated agencies are Equal Opportunity Employers, including with respect to veteran status and individuals with disabilities.

The MTA encourages qualified applicants from diverse backgrounds, experiences, and abilities, including military service members, to apply.