Senior Product Security Assurance Analyst; term-limited

Salary range is $81k to $180k, with a midpoint of $129k. New hires typically receive between minimum and midpoint, however, we may go slightly higher based on experience, internal equity and market.

Sound Transit also offers a competitive benefits package with a wide range of offerings, including:

• Health Benefits:
  
  We offer two choices of medical plans, a dental plan, and a vision plan all at no cost for employee coverage; comprehensive benefits for employees and eligible dependents, including a spouse or domestic partner.
• Long-Term Disability and Life Insurance.
• Employee Assistance Program.
• Retirement Plans: 401a – 10% of employee contribution with a 12% match by Sound Transit; 457b – up to IRS maximum (employee only contribution).
• Paid Time Off:
  Employees accrue 25 days of paid time off annually with increases at four, eight and twelve years of service. Employees at the director level and up accrue additional days. We also observe 12 paid holidays and provide up to 2 paid floating holidays and up to 2 paid volunteer days per year.
• Parental Leave: 12 weeks of parental leave for new parents.
• Pet Insurance.
• ORCA Card:
  All full-time employees will receive an ORCA card at no cost.
• Tuition Reimbursement:
  Sound Transit will pay up to $5,000 annually for approved tuition expenses.
• Inclusive Reproductive Health Support Services.
• Compensation Practices:
  We offer competitive salaries based on market rates and internal equity. In addition to compensation and benefits, you’ll find that we provide work-life balance, opportunities for professional development and recognition from your colleagues.

This is a term limited position of 5 years.

Under general direction, the Security Assurance Analyst assists with the operations of the Agency’s Information Security program for its technology assets. The Security Assurance Analyst plays a critical role in safeguarding the agency’s digital assets by conducting individual system audits, assisting in vulnerability management tasks, security control configuration management, and other security assurance efforts required to ensure major systems and applications comply with internal security controls and industry requirements.

This position requires technical expertise, critical thinking, and the ability to collaborate across teams to ensure a resilient security posture.

The following duties are a representative summary of the primary duties and responsibilities. Incumbent(s) may not be required to perform all duties listed and may be required to perform additional, position-specific duties.

• Conduct security reviews of systems and applications to ensure they follow internal requirements and industry standards (ISO 27001, NIST, etc.).
• Support internal and external audits of agency-wide applications through ongoing collection, validation, and organization of compliance evidence.
• Lead/Manage focused penetration testing, code analysis, segmentation testing, etc.
• Conduct system-specific vulnerability assessments.
• Translate agency security policy into actionable product-level requirements.
• Support security incident response activities.
• Advise on security control requirements for ongoing technology implementations.
• Manage vulnerability remediation efforts.
• Participate in the creation and management of information security governance documents (policies, standards, baselines, guidelines, and procedures).
• Review system architecture and design documents for principles of security by design.
• Ensure adherence to secure coding, encryption, and data handling standards for new applications.
• Track relevant assurance program metrics.
• Prepare regular reports on relevant metrics for different stakeholders.
• Maintain up-to-date detailed knowledge of the IT security industry…