Senior Cybersecurity Governance & Risk Lead

Cybersecurity Jobs; Washington (District of Columbia); Hybrid; USD 113,000 - 147,000; Full time

Benefits offered by this job

Health, Dental, and Vision Insurance

401K with Employer Match

Generous Paid Time Off

Railroad Retirement Benefits

Paid Caregiving Days and Backup Care

Job summary

Amtrak is seeking a Principal Cybersecurity Systems Security Officer to lead governance and risk management for assigned systems, ensuring security is built into design and day-to-day operations. You will coordinate cybersecurity staff and partners to reduce risk and support operational objectives.

You will develop documentation (SSPs, risk assessments, remediation plans), lead security reviews, and drive attestation activities to maintain audit readiness.

Qualifications

• Bachelor’s degree or equivalent with relevant experience.
• 7 years of relevant work experience, or 11+ years in lieu of degree.
• ISC2 CISSP certification required.

Responsibilities

• Develop and maintain security documentation (SSPs, Security Design Reviews, SDDS, risk assessments, remediation plans).
• Act as primary cybersecurity advisor for Agile Release Trains (ARTs), embedding security-by-design and risk mgmt into PI Planning and solution delivery.
• Lead security architecture reviews to uncover gaps, evaluate risks, and select mitigating controls.
• Coordinate with engineering, architecture, and operations to integrate security requirements into system design and change management processes.
• Lead assessment and audit readiness efforts, maintaining evidence strategies and timely closure of findings.

Skills

Security governance

Risk management

Security architecture

DevSecOps

Audit readiness

Education

Bachelor's degree

CISSP

CISM

CISA

CRISC

GCIH

GPEN

CEH

CHFI

Security+

CASP

OSCP

Tools

ISO/IEC 27001

NIST RMF

NIST CSF

CIS Controls

GRC tooling

OT/ICS

Job description

Amtrak is seeking a Principal Cybersecurity Systems Security Officer to lead governance and risk management for assigned systems, ensuring security is built into design and day-to-day operations. You will coordinate cybersecurity staff and partners to reduce risk and support operational objectives.

You will develop documentation (SSPs, risk assessments, remediation plans), lead security reviews, and drive attestation activities to maintain audit readiness.