Cybersecurity Engineer (Test & Evaluation)

City of New York•New York, NY

4d•$75,000 - $95,000•Onsite

About The Position

The Cybersecurity Engineer (Test & Evaluation) will support the Cyber Test team’s mission of conducting technical security testing—including red teaming, penetration testing, and threat/adversary emulation—against systems and environments belonging to City agencies. The role also provides technical subject matter expertise to Cyber Command and partner agencies on vulnerability exploitability, technical risk, and the review of testing artifacts submitted in support of risk acceptance and policy exception determinations. The Office of Technology and Innovation (OTI) uses technology to drive opportunity, improve public safety, and help government run better across New York City. Cyber Command protects City systems against cyber threats and provides in-depth support to more than 100 agencies and offices to protect, detect, identify, respond to, and recover from threats. This position is based in Brooklyn, NY, and may require varied shifts, including weekends and nights or evenings, because of the technical duties of a 24/7 operation.

Requirements

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or equivalent education and/or experience.

Responsibilities

Assist in planning and executing technical security assessments, including penetration tests, red team engagements, and adversary or threat emulation exercises, against City agency systems, applications, and network environments.
Help identify and validate vulnerabilities and assess their real-world exploitability and operational impact.
Document findings, methodology, and evidence in clear, actionable testing reports for technical and non-technical stakeholders.
Assist in evaluating the technical validity of risk review submissions, including risk acceptance and policy exception requests, by reviewing testing artifacts, scan results, and assessment documentation.
Test the effectiveness of claimed compensating controls through red teaming or threat emulation.
Translate technical testing findings into language and context suited to an agency or Cyber Command function.
Analyze findings across engagements to identify recurring patterns, systemic weaknesses, or root causes, and share recommendations to inform broader remediation and mitigation strategies.
Map testing findings and assessments to recognized control frameworks, such as CIS Controls and NIST, to support consistent, defensible risk-informed determinations.
Maintain awareness of current threat actor tactics, techniques, and procedures and incorporate relevant threat intelligence into testing scenarios, risk discussions, and trend analysis.
Contribute to the continuous improvement of Cyber Test methodologies, tooling, and reporting standards.
Handle special projects and initiatives as assigned.