Principal Cybersecurity Systems Security Officer

Select how often (in days) to receive an alert:

Date:
Sep 16, 2026

Location:

Washington, DC, US, 20001 US Wilmington, DE, US, 19801 Philadelphia, PA, US, 19104

Company:
Amtrak

Your success is a train ride away!

As we move America’s workforce toward the future, Amtrak connects businesses and communities across the country. We employ more than 20,000 diverse, energetic professionals in a variety of career fields throughout the United States. The safety of our passengers, our employees, the public and our operating environment is our priority, and the success of our railroad is due to our employees.

Are you ready to join our team?

Our values of ‘Do the Right Thing, Excel Together and Put Customers First’ are at the heart of what matters most to us, and our Core Capabilities, ‘Building Trust, Accountability, Effective Communication, Customer Focus, and Proactive Safety & Security’ are what every employee needs to know and do to be most impactful  living the Amtrak values, focusing on our capabilities, and actively embracing and fostering diverse ideas, backgrounds, and perspectives, together we will honor our past and make Amtrak a company of the future.

The Principal Cybersecurity Systems Security Officer leads the cybersecurity governance and risk management program for assigned systems and services, ensuring they operate at an acceptable level of risk and remain assessment- and audit-ready. This role establishes security governance, drives control effectiveness, and integrates security requirements into system design, engineering, operations, and sustainment activities. Oversees continuous monitoring, assessment readiness, and remediation execution, translating control gaps into clear risk decisions and prioritized actions.

The role manages and develops cybersecurity staff and partners closely with engineering, operations, compliance, and business leadership to deliver measurable risk reduction while supporting availability, reliability, and operational objectives.

Essential Functions:

• Develop and maintain security documentation, including System Security Plans (SSPs), Security Design Reviews, Secure Design Directives (SDDs), risk assessments, exception requests, and remediation plans.
• Serve as the primary cybersecurity advisor for Agile Release Trains (ARTs), partnering with business, portfolio, product, architecture, and engineering stakeholders to integrate security-by-design principles, Dev Sec Ops  practices, and risk management activities into Program Increment (PI) Planning and solution delivery processes.
• Perform security architecture and design reviews to identify security gaps, evaluate risks, and design appropriate mitigating and compensating controls.
• Lead assessment, audit, and assurance readiness activities by establishing evidence strategies, maintaining high-quality security documentation, coordinating reviews, and ensuring timely closure of findings and gaps.
• Drive security assessment and authorization or attestation activities by ensuring security plans, control implementations, and decision artifacts are current, traceable, and defensible.
• Drive continuous monitoring programs by defining required security telemetry, reviewing control health, overseeing vulnerability and configuration management activities, and monitoring residual risk trends.
• Lead risk decision-making by prioritizing remediation activities, adjudicating exceptions and compensating controls, and escalating material risks with clear impact statements and recommended actions.
• Partner with engineering, architecture, and operations stakeholders to integrate security requirements into system design, change management, release readiness, and lifecycle sustainment…