Principal Cybersecurity Systems Security Officer

Cybersecurity Jobs; Washington (District of Columbia); Hybrid; USD 113,000 - 147,000; Full time

Benefits offered by this job

Health, Dental, and Vision Insurance

401K with Employer Match

Generous Paid Time Off

Railroad Retirement Benefits

Paid Caregiving Days and Backup Care

Job summary

Amtrak is seeking a Principal Cybersecurity Systems Security Officer to lead governance and risk management for assigned systems, ensuring security is built into design and day-to-day operations. You will coordinate cybersecurity staff and partners to reduce risk and support operational objectives.

You will develop documentation (SSPs, risk assessments, remediation plans), lead security reviews, and drive attestation activities to maintain audit readiness.

Qualifications

• Bachelor’s degree or equivalent with relevant experience.
• 7 years of relevant work experience, or 11+ years in lieu of degree.
• ISC2 CISSP certification required.

Responsibilities

• Develop and maintain security documentation (SSPs, Security Design Reviews, SDDS, risk assessments, remediation plans).
• Act as primary cybersecurity advisor for Agile Release Trains (ARTs), embedding security-by-design and risk mgmt into PI Planning and solution delivery.
• Lead security architecture reviews to uncover gaps, evaluate risks, and select mitigating controls.
• Coordinate with engineering, architecture, and operations to integrate security requirements into system design and change management processes.
• Lead assessment and audit readiness efforts, maintaining evidence strategies and timely closure of findings.

Skills

Security governance

Risk management

Security architecture

DevSecOps

Audit readiness

Education

Bachelor's degree

CISSP

CISM

CISA

CRISC

GCIH

GPEN

CEH

CHFI

Security+

CASP

OSCP

Tools

ISO/IEC 27001

NIST RMF

NIST CSF

CIS Controls

GRC tooling

OT/ICS

Job description

The Principal Cybersecurity Systems Security Officer at Amtrak provides cybersecurity governance and risk management for assigned systems and services, with a focus on maintaining acceptable risk levels and audit readiness. This position establishes security governance practices, improves control effectiveness, and ensures security is built into system design and day-to-day operations while coordinating cybersecurity staff and partners to reduce risk and support operational objectives.

Key responsibilities

• Develop and maintain security documentation, including System Security Plans (SSPs), Security Design Reviews, Secure Design Directives (SDDs), risk assessments, exception requests, and remediation plans.
• Act as the primary cybersecurity advisor for Agile Release Trains (ARTs), working with business, portfolio, product, architecture, and engineering stakeholders to embed security-by-design, DevSecOps practices, and risk management into Program Increment (PI) Planning and solution delivery.
• Lead security architecture and design reviews to uncover security gaps, evaluate risks, and select mitigating and compensating controls.
• Lead assessment and audit assurance readiness by setting evidence strategies, maintaining high-quality security documentation, coordinating reviews, and ensuring timely closure of findings and gaps.
• Drive security assessment and authorization or attestation activities by keeping security plans, control implementations, and decision artifacts current, traceable, and defensible.
• Operate and evolve continuous monitoring programs by defining security telemetry needs, reviewing control health, overseeing vulnerability and configuration management activities, and tracking residual risk trends.
• Lead risk decision-making, including prioritizing remediation, adjudicating exceptions and compensating controls, and escalating material risks with impact statements and recommended actions.
• Coordinate with engineering, architecture, and operations stakeholders to integrate security requirements into system design, change management, release readiness, and lifecycle sustainment processes.

Required qualifications

• Bachelor’s Degree or equivalent combination of education, training, and/or relevant experience.
• 7 years of relevant work experience, or 11+ years in lieu of degree.
• ISC2 CISSP (Certified Information Systems Security Professional).

Preferred qualifications

• Bachelor’s Degree in Cybersecurity, Information Systems, or equivalent combination of education, training, and/or relevant experience, plus 9 years of relevant work experience.
• Industry-standard certifications such as CISM, CISA, CRISC, GCIH, GPEN, CEH, CHFI, Security+, CASP, OSCP, and others.

Tools, frameworks, and technologies

• Agile Release Trains (ARTs), DevSecOps, Program Increment (PI) Planning
• ISO/IEC 27001, NIST RMF, NIST CSF, CIS Controls
• GRC tooling, OT/ICS, and DOT regulations

Location and work arrangement

• Washington, DC, Philadelphia, PA, or Wilmington, DE (remote)
• Work arrangement: 02-Remote Optional
• Relocation offered: No
• Travel requirements: 0 - 5%

Compensation

USD 113,200 - 146,664 per year.

Additional details

• Minimum experience: 7 years
• Requisition ID: 167049

Benefits

• Health, Dental, and Vision Insurance
• 401K with Employer Match
• Generous Paid Time Off
• Wellness Programs
• Railroad Retirement Benefits
• Paid Caregiving Days and Backup Care
• Health Savings Account
• Public Service Student Loan Forgiveness
• Fertility and Family Building Benefits
• No-cost Personal Health Advocate
• Student Loan Assistance
• Adoption and Surrogacy Assistance
• Medical Plan Opt-out Credit
• Tuition and Education Reimbursement
• Paid Family Leave
• Life Insurance
• Rail Pass Privileges
• Short- and Long-term Disability Insurance
• Employee Assistance Program
• No-cost Financial Advisor Sessions
• Commuter and Flexible Spending Accounts

Knowledge, skills, and abilities

• Build cross-functional alignment and lead complex cross-functional programs.
• Strong written and verbal communication skills, including translating technical findings and regulatory requirements.
• Demonstrated experience performing security architecture reviews, risk assessments, threat modeling, vulnerability management, and security control evaluations across applications, infrastructure, networks, and cloud environments.
• Demonstrated success building or scaling an ISSO/ISSM operating model across multiple products, platforms, or business units.
• Expert knowledge of cybersecurity governance, risk management, and control frameworks, including mapping requirements to implemented controls and measurable evidence.
• Design and operate continuous monitoring programs, including security telemetry, vulnerability management, configuration baselines, exception handling, and metrics.
• Lead audit and assurance activities, including preparing control narratives, evidence packages, and stakeholder responses under tight deadlines.
• Experience implementing or operating an ISO/IEC 27001-aligned information security management system (ISMS) and supporting external audits and attestations.
• Strong knowledge of cybersecurity frameworks and standards, including NIST RMF, NIST CSF, CIS Controls, and other applicable industry and regulatory frameworks.
• Knowledge of OT/ICS cybersecurity principles, including cyber-to-physical risk, safety impacts, and operational constraints that affect control selection and implementation.
• Experience with GRC tooling (controls library management, evidence workflows, risk registers) and security KPI/KRI design.
• Experience coordinating third-party risk and contract security requirements for cloud/SaaS and managed service providers.