Principal Cybersecurity Systems Security Officer

The Principal Cybersecurity Systems Security Officer at Amtrak provides cybersecurity governance and risk management for assigned systems and services, with a focus on maintaining acceptable risk levels and audit readiness. This position establishes security governance practices, improves control effectiveness, and ensures security is built into system design and day-to-day operations while coordinating cybersecurity staff and partners to reduce risk and support operational objectives.

• Develop and maintain security documentation, including System Security Plans (SSPs),
  Security Design Reviews
  , Secure Design Directives (SDDs), risk assessments, exception requests, and remediation plans.
• Act as the primary cybersecurity advisor for Agile Release Trains (ARTs), working with business, portfolio, product, architecture, and engineering stakeholders to embed security-by-design,
  Dev Sec Ops practices, and risk management into Program Increment (PI) Planning and solution delivery.
• Lead security architecture and design reviews to uncover security gaps, evaluate risks, and select mitigating and compensating controls.
• Lead assessment and audit assurance readiness by setting evidence strategies, maintaining high-quality security documentation, coordinating reviews, and ensuring timely closure of findings and gaps.
• Drive security assessment and authorization or attestation activities by keeping security plans, control implementations, and decision artifacts current, traceable, and defensible.
• Operate and evolve continuous monitoring programs by defining security telemetry needs, reviewing control health, overseeing vulnerability and configuration management activities, and tracking residual risk trends.
• Lead risk decision-making, including prioritizing remediation, adjudicating exceptions and compensating controls, and escalating material risks with impact statements and recommended actions.
• Coordinate with engineering, architecture, and operations stakeholders to integrate security requirements into system design, change management, release readiness, and lifecycle sustainment processes.

• Bachelor’s Degree or equivalent combination of education, training, and/or relevant experience.
• 7 years of relevant work experience, or 11+ years in lieu of degree.
• ISC2 CISSP (Certified Information Systems Security Professional).

• Bachelor’s Degree in Cybersecurity, Information Systems
  , or equivalent combination of education, training, and/or relevant experience, plus 9 years of relevant work experience.
• Industry-standard certifications such as CISM
  , CISA
  , CRISC
  , GCIH
  , GPEN
  , CEH
  , CHFI
  , Security+,
  CASP
  , OSCP
  , and others.

• Agile Release Trains (ARTs), Dev Sec Ops , Program Increment (PI) Planning
• ISO/IEC 27001
  , NIST RMF
  , NIST CSF
  , CIS Controls
• GRC tooling,
  OT/ICS
  , and DOT regulations

• Washington, DC
  , Philadelphia, PA
  , or Wilmington, DE (remote)
• Work arrangement: 02-Remote Optional
• Relocation offered: No
• Travel requirements: 0 - 5%

USD 113, per year.

• Minimum experience: 7 years
• Requisition : 167049

• Health, Dental, and Vision Insurance
• 401K with Employer Match
• Generous Paid Time Off
• Wellness Programs
• Railroad Retirement Benefits
• Paid Caregiving Days and Backup Care
• Health Savings Account
• Public Service Student Loan Forgiveness
• Fertility and Family Building Benefits
• No-cost Personal Health Advocate
• Student Loan Assistance
• Adoption and Surrogacy Assistance
• Medical Plan Opt-out Credit
• Tuition and Education Reimbursement
• Paid Family Leave
• Life Insurance
• Rail Pass Privileges
• Short- and Long-term Disability Insurance
• Employee Assistance Program
• No-cost Financial Advisor Sessions
• Commuter and…