Manager of Cyber Security Services (CSS)

• Utilizing a risk-based approach to manage information security related aspects of HRT’s operations.
• Assuring compliance with information security, privacy, and industry standards and regulations.
• Designing, establishing, and maintaining reasonable organizational cyber security and information privacy postures.
• Implementing the NIST Cybersecurity Framework within the organization to improve cyber resilience.
• In coordination with key stakeholders, this position communicates, prepares for, and responds to geopolitical, international and national cyber threats from an Agency perspective.

• Works with CIO/CTO to define, implement and maintain corporate information and operations technology security policies, procedures, and guidelines based on industry best practices that are compliant with federal and state regulations.
• Maintaining awareness of new cyber threats, vulnerabilities, and technologies to keep the organization secure.
• Conducting risk assessments to identify potential security threats and vulnerabilities.
• Monitoring network activity to identify signs of intrusion or compromise.
• Providing technical support for computer networks, including firewalls, operating systems and applications, patch management, and data security best practices.
• Manage HRT’s security tool suite in including endpoint protection, vulnerability assessment, log

• Conducting audits to ensure security protocols are being followed by staff.
• Providing training in information security best practices to employees.
• Working knowledge with industry standards such as HIPAA, ITIL, NIST, SANS, COBIT, OWASP, and ISO.
• Own the entire IT audit process for SOC & PCI reporting across the enterprise.
• Responsible for leading vulnerability audits, forensic investigations, and mitigation procedures.
• Responds immediately to security-related incidents, leads response team, and provides post-event analysis.
• Evaluate new cybersecurity threat and IT trends and develop effective security controls.
• Evaluate potential security breaches, coordinate response, and recommend corrective actions.
• Monitor compliance with security policies and procedures.
• Investigate security breaches and incidents.
• Coordinate incident response activities.
• Train and educate employees on security awareness.
• Manage security vendors and service providers.
• Take proactive role is procurement process from the cyber security perspective.
• Manage department budget, take part in annual capital expenditures planning exercises.
• Manage records created and received in compliance with the Hampton Roads Transit Records Management Policy and Procedures.
• Responsible for maintaining a general awareness of HRT’s EMS.
• Responsible for handling all related job responsibilities in accordance with HRT’s Environmental Policy, relevant Emergency Management System (EMS) Standard Operating Procedures, and Emergency Management Plan.

• Bachelor’s degree in computer science, information technology, or related field.
• 10+ years of experience in IT security, including 5+ years in a management or lead role.
• Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP) Certification or similar certification.
• Experience with a diverse body of technical cyber tools and software.
• In-depth knowledge of cyber security principles and best practices.
• Experience developing and implementing security policies and procedures.
• Demonstrated Experience in Network Engineering.
• Project management experience.
• Certification in CompTIA Security+.
• Ability to effectively present information and respond to questions from senior management, groups of managers, clients and internal and external customers.
• Ability to handle multiple tasks simultaneously and meet multiple deadlines.
• Excellent written and verbal communication skills.

• Strong background in Windows security management and security architecture.
• Background in application security analysis, design, and testing.
• Experience in network traffic flow monitoring and analysis tools.
• Experience in log aggregation and analysis tools.
• Experience with vulnerability assessment tools.
• Experience with endpoint protection tools.
• Experience with Internet of Things / Operational Technology security.
• Experience with a diverse suite of cyber and network tools.
• Experience with physical security access control systems and video surveillance systems.

CMT Services