Cybersecurity Engineer (Test & Evaluation)

City of New York•Brooklyn, NY

3d•Onsite

About The Position

The Office of Technology and Innovation (OTI) uses technology to improve opportunity, public safety, and government services across New York City. Its Cyber Command protects City systems—including systems that deliver vital services—from cyber threats and supports more than 100 agencies and offices in protecting, detecting, identifying, responding to, and recovering from threats. The Cybersecurity Engineer (Test & Evaluation) supports the Cyber Test team’s technical security testing mission. This includes red teaming, penetration testing, and threat/adversary emulation of City agency systems and environments. The role also provides technical subject matter expertise to Cyber Command and partner agencies on vulnerability exploitability and technical risk, and reviews testing artifacts submitted for risk acceptance and policy exception determinations. The position is based in Brooklyn, NY, with day hours; because the work supports a 24/7 operation, various shifts, including weekends and nights or evenings, may be required.

Requirements

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or equivalent education and/or experience.

Responsibilities

Assist in planning and executing technical security assessments, including penetration tests, red team engagements, and adversary/threat emulation exercises, against City agency systems, applications, and network environments.
Help identify and validate vulnerabilities and assess their real-world exploitability and operational impact.
Document findings, methodology, and evidence in clear, actionable testing reports for technical and non-technical stakeholders.
Assist in evaluating risk review submissions, including risk acceptance and policy exception requests, by reviewing supporting testing artifacts, scan results, and assessment documentation.
Test the effectiveness of claimed compensating controls through red teaming or threat emulation.
Translate technical testing findings into language and context suited to an agency or Cyber Command function.
Analyze findings across engagements to identify recurring patterns, systemic weaknesses, and root causes, and share recommendations to inform remediation and mitigation strategies.
Map testing findings and assessments to recognized control frameworks, such as CIS Controls and NIST.
Maintain awareness of threat actor tactics, techniques, and procedures and incorporate relevant threat intelligence into testing scenarios, risk discussions, and trend analysis.
Contribute to continuous improvement of Cyber Test methodologies, tooling, and reporting standards.
Handle special projects and initiatives as assigned.