Cybersecurity & Infrastructure Lead

Marquette-Alger RESA•Marquette, MI

1d•$93,917 - $115,506•Onsite

About The Position

The Cybersecurity & Infrastructure Lead leads cybersecurity, cloud governance, and compliance implementation across Marquette-Alger RESA and partner districts. Reporting to the Chief Technology Officer (CTO), the Lead owns security controls across AWS, Microsoft Azure, and Google Cloud Platform (GCP), and prepares the Agency for SOC 2 and ISO 27001:2022 audits. The role establishes accountability for controls, enforces role-based and least-privilege access, manages endpoint security, and ensures sensitive data is handled in alignment with HIPAA, COPPA, FERPA, and GDPR. It also governs the security of artificial intelligence and machine learning workloads. The Lead directly owns security-critical infrastructure controls tested in audits, including firewalls, vulnerability management, backups, logging, and physical access requirements. Day-to-day network and server operations are performed by the Technology Director under security requirements set by the Lead. The position is full-time and in person at the Marquette, Michigan location; remote work is not available. It is a 12-month, non-union position.

Requirements

Five or more years of hands-on Information Technology experience, including cloud security and administration across AWS, Microsoft Azure, and GCP.
Current professional- or specialty-level certification from at least one of the following: AWS Certified Security – Specialty or Certified Solutions Architect – Professional; Microsoft Azure Cybersecurity Architect Expert or Azure Solutions Architect Expert; or Google Cloud Professional Cloud Security Engineer or Professional Cloud Architect.
Demonstrated experience leading or directly supporting a SOC 2 audit, an ISO 27001 certification, or both.
Ability to establish and enforce security requirements for technical teams, including data scientists, engineers, and architects.
Hands-on identity and access management experience, including RBAC, multifactor authentication, and privileged access across Active Directory, Entra ID (Azure), and Google Workspace.
Hands-on experience managing enterprise firewalls, vulnerability management, and backup systems.
Working knowledge of HIPAA, COPPA, FERPA, and GDPR as they apply to data handling and cloud storage.
Ability to work independently, manage multiple projects simultaneously, and meet timelines.
Ability to establish and maintain positive relationships and collaborate and solve problems with diverse partners and stakeholders.
Excellent interpersonal, verbal, and written communication skills.
Ability to serve students, staff, and the public pleasantly and efficiently.
Ability to act fairly and ethically and handle confidential information with discretion.
Must keep the affairs of Marquette-Alger RESA and LEAs confidential and uphold confidentiality of privileged and sensitive student and staff information.
Must have regular and reliable job attendance, performance, and the physical ability to do the job.
Regularly sit or stand for extended periods and be able to walk, bend, and reach to inspect hardware or network infrastructure.
Frequently use hands and fingers to operate computer keyboards and specialized technical tools.
Occasionally lift, carry, or move hardware weighing up to 35 pounds.
Be able to read technical manuals and monitors and communicate clearly in person or via digital platforms, often in environments with moderate ambient noise.

Nice To Haves

Experience governing enterprise AI deployments, including Amazon Bedrock, and a working understanding of deep learning workflows.
Hands-on experience with AWS services such as EC2, S3, IAM, VPC, CloudFront, CloudTrail, and KMS; Azure services such as Virtual Machines, Blob Storage, Azure DevOps, Front Door, Key Vault, and Defender for Cloud; and Google Cloud services such as Compute Engine, Cloud Storage, Cloud Shell, Cloud CDN, Cloud IAM, and Security Command Center.
Experience deploying and securing Azure Virtual Desktop or Windows 365 Cloud PC for regulated workloads.
Experience with a SIEM platform such as Elastic Cloud or Microsoft Sentinel, and infrastructure as code such as Terraform, AWS CloudFormation, or Azure Bicep.
Compliance, audit, or privacy certifications such as CISA, CISM, CISSP, CCSP, ISO 27001 Lead Implementer or Lead Auditor, CIPP/E, or CIPM.
Experience with a compliance automation platform, preferably Vanta, and frameworks such as NIST and the CIS Critical Security Controls.
Bachelor’s degree in technology, computer science, computer information systems, or a related field, or an equivalent combination of significant education, training, certifications, and experience.
Server+, Network+, CCNA, or similar certifications.
Prior experience in a local school district, ISD, or RESA.

Responsibilities

Lead the Agency’s SOC 2, ISO 27001:2022, and GDPR compliance programs, from gap assessment through successful audit.
Administer AWS, Microsoft Azure, and GCP at the organization level, including account, subscription, and project structures and the guardrail policies applied across them.
Establish security and compliance controls for Amazon Bedrock and other AI services, including access approvals, guardrails, and logging.
Set security standards for data scientists, machine learning engineers, and architects, and review and approve system designs against control requirements.
Design and enforce role-based access control and least-privilege access across cloud platforms, identity providers, and Agency applications.
Secure cloud compute, storage, content delivery networks, and development pipelines through hardened configurations, encryption, key management, and controlled deployment.
Design and secure Azure virtual desktop environments for staff handling HIPAA-protected and other highly sensitive data, ensuring regulated data is not stored on local devices.
Establish and maintain the ISO 27001:2022 Information Security Management System (ISMS), including the Statement of Applicability, risk treatment plan, and internal audits.
Own firewall configuration and reviews, vulnerability scanning and patch deadlines, and backup systems, including regular restore testing.
Centralize security logging and monitoring to ensure visibility and rapid response to potential threats.
Enforce access management, including multifactor authentication, privileged access controls, credential rotation, and periodic access reviews.
Ensure data and cloud storage are handled in alignment with HIPAA, COPPA, FERPA, and GDPR, including inventory, classification, retention, and deletion.
Develop, document, and enforce information security policies and procedures in collaboration with the CTO and department leadership.
Implement, test, and maintain security controls in the Agency’s Vanta compliance automation platform, ensuring every control has a named owner and failing items are remediated on schedule.
Define security requirements for systems operated by the Technology Director and verify compliance through reviews of configurations, logs, and evidence.
Define device compliance policies and enforce endpoint security standards, including disk encryption, malware protection, screen lock, and patching.
Conduct the annual risk assessment, maintain the risk register, and assess the security posture of vendors and third parties.
Collaborate with department leadership on incident response planning, documentation, and procedures.
Set physical access requirements, approve access levels, and review access records for door access and surveillance systems.
Prepare and maintain audit evidence, control documentation, and system descriptions, and coordinate auditor requests during examination and certification periods.
Develop security awareness training content for employees and verify staff completion.
Maintain professional competence through ongoing education regarding statutes, regulations, and IT standards to ensure the Agency uses current best practices.
Report compliance status, security gaps, and audit risks directly to the CTO.
Perform other duties as assigned.