Director of IT Risk & Compliance Strategy

Massachusetts Bay Transportation Authority (MBTA); Boston (MA); On-site; USD 180,000 - 240,000; Full time

Job summary

MBTA is seeking a Deputy Director of IT Risk & Compliance Management to provide strategic and operational leadership over enterprise technology risk, compliance, and governance across the MBTA. The role safeguards information assets by implementing security and privacy controls, managing vendor risk, and translating risk posture for executives.

The position leads a team of risk analysts and compliance specialists, aligns with NIST, ISO, and privacy regulations, and collaborates with Procurement,

Qualifications

• Bachelor’s degree in Computer Science or related field.
• Five (5) years of progressive IT risk, compliance, or cybersecurity governance experience in large, complex environments.
• Two (2) years of supervisory, managerial, and/or leadership experience.
• Demonstrated implementation of NIST800-53/CSF, ISO27001/27701, CISControls, ITIL, COBIT, and privacy regulations.

Responsibilities

• Direct the risk management lifecycle—identification, assessment, response, monitoring—for IT and OT systems, aligning with NIST CSF, NIST800-53, ISO27001, CIS, and privacy mandates.
• Maintain an authoritative Risk Register and oversee continuous control testing and issue management.
• Design and run a robust SCRM program with third-party onboarding, due-diligence assessments (SOC2, ISO27001, PCI DSS, FedRAMP, CMMC).
• Coordinate with Procurement and Legal to embed security clauses and right-to-audit provisions in contracts.
• Develop and maintain MBTA information security and privacy policies; drive adoption via awareness campaigns and phishing simulations.

Skills

Risk management

Compliance governance

Security leadership

Executive communication

Vendor risk

Policy governance

Awareness campaigns

GRC administration

Auditing coordination

Data privacy

Education

Bachelor's degree in CS or related field

Tools

ServiceNow GRC

Archer

Origami

Armis

Nazomi

Job description

MBTA is seeking a Deputy Director of IT Risk & Compliance Management to provide strategic and operational leadership over enterprise technology risk, compliance, and governance across the MBTA. The role safeguards information assets by implementing security and privacy controls, managing vendor risk, and translating risk posture for executives.

The position leads a team of risk analysts and compliance specialists, aligns with NIST, ISO, and privacy regulations, and collaborates with Procurement,