Cybersecurity Engineer Level 4 - PAM

9:00 am - 5:30 pm (7.5 hours/day) or as required

This position is eligible for telewor k ing, which is currently one day per week . New hires are eligible to apply 30 days after their effective date of hire.

The Metropolitan Transportation Authority is North America's largest transportation network, serving a population of 15.3 million people across a 5,000-square-mile travel area surrounding New York City, Long Island, southeastern New York State, and Connecticut. The MTA network comprises the nation’s largest bus fleet and more subway and commuter rail cars than all other U.S. transit systems combined. MTA strives to provide a safe and reliable commute, excellent customer service, and rewarding opportunities.

The purpose of this position is to provide technical expertise in managing and analyzing cybersecurity risks. Cybersecurity Engineer will be responsible for designing, building, and maintaining infrastructure and applications technology to support a secure cybersecurity posture. These include systems that support cybersecurity directly and/or the business operations for Information and Operational Technology disciplines. Secure building and configuration of systems (applications, infrastructure, wireless, carrier systems, cloud, operational technology, IOT, etc.)

from the outset reduces risk to MTA. Specialized and focused skill sets in various technology domains assist with the overall risk reduction for the MTA. The configuration, hardening, guidance, response, and analysis of these systems aid in the reduction and containment of Cyber Security risk. Risk assessments, data analytics tools, operational process reviews, and collaboration with security engineers, architects, developers, vendors, and business units to constantly improve the overall security of the MTA .

• Experience in Identity and Access Management or a related security role
• Working knowledge of identity fundamentals, including authentication, authorization, least privilege, RBAC, segregation of duties, and joiner/mover/leaver processes
• Hands-on experience administering Active Directory and Microsoft Entra
• Scripting experience (Power Shell, Python) to automate routine tasks
• Experience working in Service Now or a similar ITSM platform
• Strong documentation and communication skills, with the ability to work across technical and business teams
• Experience following change management and audit requirements in a regulated environment
• Experience with one or more of the following areas:
• Privileged Access Management: enterprise PAM platforms (Beyond Trust preferred; Cyber Ark or Delinea acceptable), credential vaulting, session management, password rotation, just-in-time access, and service account governance
• Identity Governance and Administration:
  SailPoint Identity IQ or Identity Security Cloud (or equivalent), access certifications, role and entitlement management, SoD policies, application onboarding, and audit reporting
• Access Management: provisioning and deprovisioning, access request fulfillment, AD/Entra group and file-share administration, MFA/SSO support (Duo, Okta), and access cleanup

• Researching emerging threats and vulnerabilities to aid in the identification of network incidents, and supporting the creation of new architecture, policies, standards, and guidance to address them
• Knowledge and practical implementation of secure system configuration and hardening standards
• Design, configure, and integrate secure solutions in the technology domains assigned
• Provide incident response support, including mitigating actions to contain activity and facilitating forensic analysis, system hardening, and recovery when necessary
• Provides installation, system configuration, hardening,…