• Leadership
  • Provide leadership to a strong talent pool of technical professionals
  • Lead a team of multi-functional technical staff planning, building, and maintaining cybersecurity tools, configurations, and risk mitigation to support Information and Operational Technology applications and/or infrastructure products
  • Lead others, as appropriate, and when necessary, that will consist of one or more agile coaches, data analytic researchers, and other cybersecurity personnel
  • Provide leadership in development of inter-team communication and cohesiveness; sustain culture and supporting assigned staff during organizational growth/changes.
  • Provide direction on evaluation, selection, implementation, and maintenance of cybersecurity tools, processes, and techniques for their assigned cyber domains and products, ensuring appropriate investment in strategic and operational systems.
  • Leads teams to complete projects when a project manager has not been assigned.
  • Attain significant achievements managing technical teams, contractors, and vendors.
• Human Resource Management
  • Attract, develop, coach and retain high-performance team members, empowering them to elevate their level of responsibility, span of control and performance in conjunction with the Cybersecurity Management and IT Workforce Planning & Workload Management office.
  • Build staff expertise and competence to meet evolving demands within the Enterprise Product Management unit.
• Financial Management
  • Demonstrate consistent understanding of funding, communications and systems; recommend timelines and resources needed to achieve the program goals.
  • Collaborates with IT Business Management Services to identify procurement contracts to support program-related activities.
• Strategy & Planning
  • Assesses and makes recommendations on the improvement and re-engineering within the IT Department and works with the stakeholders to keep the total cost of ownership down.
  • Promotes the use of employee self -service and mobile connectivity within products to reduce the reliance on paper.
  • Recommends and supports automation of business processes, creating in-line forms and approvals, reducing the reliance on manual approvals that could be untimely.
  • Uses judgment to form conclusions that may challenge conventional wisdom
• Acquisition & Deployment
  • Coordinates and facilitates consultation with stakeholders to define business and systems requirements for new technology implementations, developing business case and cost justifications for such initiatives.
  • Provides direction on evaluation, selection, implementation and maintenance of information systems, ensuring appropriate investment in strategic and operational systems.
  • Advises MTA IT management, as information becomes available, on changing trends and emerging technology and their potential use within the MTA.
  • Directs the development of the analysis required to determine if Information Technology projects should follow a “Build” (develop with in-house staff) or “Buy” (cloud or packaged solution) methodology.
  • Manages the development and implementation of new modules within assigned products.
  • Advises on the selection, prioritization, development, and implementation on products as they relate to the selection, acquisition, development, and installation of MTA IT and OT Security, applications, and infrastructure.
• Management and Oversight
  • Participates in overall business planning, bringing current knowledge and future vision of technology and systems as related to the company’s goals.
  • Responsible for leading and reporting on various product progress and deliverables, ensuring that the IT/OT needs of the MTA are met on time and within budget, including identifying weekly, monthly and annual performance targets to show progress on IT product work and OT objectives.
  • Ensure continuous delivery of product services through oversight of service level agreements with end users and monitoring of product performance.
  • Responsible for the recruitment, development, motivation, training and retention of a diverse and high-performing multi-level IT/OT team professionals, conforming to budgetary objectives and Human Resources policy and programs in conjunction with the IT Workforce Planning & Workload Management office.
  • Develop business case justifications and cost/benefit analyses for IT spending and initiatives, keeping customizations to a minimum and total cost of ownership down.
• Cybersecurity Officer-Specific Accountabilities:
  • Planning
    • Manage and plan the future technical architecture, providing insight into the future of their area of technology in order to continually improve effectiveness and efficiency.
    • Manage and plan the development of roadmaps related to their area(s) of expertise to manage and meet identified technology needs.
    • Manage and plan the evaluation of new technologies relative to their domain(s) to determine applicability to and best meet the needs of MTA and constituent agencies.
    • Manage and ensure disaster recovery and contingency plans for their domain(s) to provide users with minimal interruptions in service.
  • Architecture
    • Oversees architectural direction for domains under management to meet senior management and cybersecurity goals.
    • Understands, reviews, and approves Cybersecurity Reference Architectures and Solutions for applying them
    • Revalidates systems to the most recent reference architectures to determine gaps, develop and manage programs to align systems to the newest standards and reference architectures
  • Contracts/Vendor Management
    • Contribute and own technical elements of RFPs and RFIs and negotiates with vendors on technical issues to ensure results are delivered in line with user and organization requirements.
    • Manages contracts and expenses to ensure SLAs and contract renewals are processed timely
    • Provide contract management support to ensure vendor deliverables are met
    • Manage and lead major projects and assigned service providers with technical expertise to address mission-critical issues, evaluate ongoing vendor service levels, and enforce SLAs and penalties.
  • Documentation
    • Ensure detailed and updated documentation is in place for cybersecurity systems and user processes.
    • Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines, and procedures) under the direction of the IT Security Manager, where appropriate.
  • Guidance, Communications and Training Support
    • Provides timely and relevant updates to appropriate stakeholders and decision makers
    • Communicates investigation findings to relevant business units to help improve the information security posture
    • Provides technical guidance to project managers and senior leadership on cybersecurity and technology strategies
    • Ensures quality, review, and guidance on tests of new systems and manages cybersecurity risks and remediation system testing, baseline, and best practices
    • Provide escalation support to project teams in their area of expertise to promote technical understanding and talent development
    • Provide guidance and take input from Analysts, Engineers, Architects, and Technology Subject Matter Experts on cybersecurity and technology best practices, current threat landscape, and a risk management approach for optimal alignment
    • Provide sound cybersecurity recommendations
  • Operations
    • Provide leadership and advisement when necessary during incident response and provide continuous improvement updates to threat model for risks to the business and systems
    • Ensure specific monitoring points are continually updated to assess performance of technologies in their domain(s). Identify and manage the necessary actions to ensure optimal performance and reliability.
  • Research & Analysis
    • Validates and maintains incident response plans and processes to address potential threats
    • Compiles and analyzes data for management reporting and metrics
    • Research emerging technologies and process improvements to stay current and plan for an evolving threat landscape to ensure strategy meets current threats
    • Monitors relevant information sources to stay up to date on current attacks and trends
    • Ensure cybersecurity technology solutions meet strategy and security framework objectives and business objectives
    • Hypothesizes new threats and indicators of compromise
    • Oversee rigorous quality assurance processes to deliver reliability, performance, and safety objectives
• Performs other duties as assigned
• Complies with all policies and standards
• May be required to work hours outside regular work hours, as applicable
• Observes the work performed by contractors, as applicable
• Reviews invoices and approves them if the work meets contractual standards, as applicable
• Addresses performance issues with the contractor when possible, as applicable
• Escalates issues to other parties when needed, as applicable

Required Qualifications:

• Bachelor’s Degree in Arts/Sciences (BA/BS). Bachelor’s degree required in Computer Science or related fields. An equivalent combination of education and experience may be considered in lieu of a degree.
• Minimum 4 years of relevant experience in one or more.
  • Cybersecurity Domains
  • Leadership ability

Competencies:

• Must possess a deep understanding of technology and cybersecurity domain principles.
• Proven ability to manage projects and initiatives.
• Proven ability to manage people.
• Proven ability to add value to a team.
• Understanding of Operating Systems, Cloud, Mobile, and Applications.
• Understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologies required (OSI Layers 5-7).
• Some Scripting or programming skills (PERL, Python, PowerShell, etc.) preferred as needed.
• Proficient in Productivity Tools (ie., Office 365, G Suite).
• Experience with Spreadsheets and Data Analysis.
• Successful track record in design of software systems to meet the current and future needs of a complex organization OR successful track record in design and implementation of IT Infrastructure and related hardware and software technologies to meet the current and future needs of a complex transportation organization.
• Strong Verbal/written communications skills.
• Financial/budgeting planning and management experience a plus.
• Ability to fit in with the constantly shifting needs and demands of the business Department

Cybersecurity Domains:

• Active Directory and Directory Services
• Identity and Access Management
• Privileged Access Management
• Cloud Security (PaaS, SaaS Applications)
• Cloud Security (DevSecOps and Tools)
• Azure and Amazon Web Services Security
• Office 365, Microsoft Dynamics Security • Application Security (Development and Configuration)
• Application Source Code Security
• Middleware Security
• Database Security
• Network Security Design
• Public Key Infrastructure
• Multifactor Authentication
• Smart Card Technology
• Operating Systems and Systems Hardening
• Desktop, Servers, and Hypervisor Security
• Mobility Security (iOS, Android, Apple, Laptops, etc.)
• Wireless Network Security (WiFi, 5G, RF/Radio, UWB, etc.)
• Carrier Network Security (DWDM, Fiber Optic Network, MPLS, etc.)
• Computer-Based Train Control (CBTC) Security
• Federal / State Regulations and Services
• Onboard Train/Bus Systems Security
• Operational Technology
• Internet of Things
• Capital Program
• Information and Operational Technology Security Training
• Positive Train Control (PTC) Security
• Red Team (OT)
• Building Management Systems
• Video Analytics
• Policy Dispatch Systems
• Mobile Device and Application Security
• Cyber Audits and Compliance
• Data Scientist
• Data Security
• PCI Security and Controls
• Penetration and Vulnerability Tester
• Procurement and Supply Chain • Red Team (IT)
• Risk Management
• Vulnerability Assessor
• Cybersecurity Training
• Forensic / Investigator
• Incident Response Analyst
• Threat Intelligence and Hunting
• Security Operations Center
• Endpoint Security and Detection Services

Other Information:

Pursuant to the New York State Public Officers Law & the MTA Code of Ethics, all employees who hold a policymaking position must file an Annual Statement of Financial Disclosure (FDS) with the NYS Commission on Ethics and Lobbying in Government (the “Commission”).

Equal Employment Opportunity:

MTA and its subsidiary and affiliated agencies are Equal Opportunity Employers, including with respect to veteran status and individuals with disabilities.

The MTA encourages qualified applicants from diverse backgrounds, experiences, and abilities, including military service members, to apply.