Information Security and Compliance Specialist

Ayoroa Simmons LLC•Lexington, KY

6d•Onsite

About The Position

The Information Security and Compliance Specialist designs, implements, and operates the security program protecting A|S's controlled project data. The role builds and administers an on-premises secured data environment for large project datasets, encrypted client correspondence, and the media and backup systems used to move and protect data. It also develops and maintains the policies, records, procedures, and training needed to support an outside audit. The specialist takes the firm from a designed security architecture to an audited, operating program and keeps it current as clients, staff, and technology change. The position works alongside the firm's IT lead and reports to the CEO. The role is based in the Lexington, Kentucky office, with periodic travel to Nashville, Washington, DC, and client sites. It is classified as full-time and exempt. The ideal candidate is an experienced systems or security administrator who has managed business infrastructure, backups, and access control, and who writes clearly. Direct experience with formal security frameworks is helpful; A|S will provide and fund training and certification needed to lead the program. Familiarity with how a technical services firm captures, processes, and delivers large project datasets is a strong plus.

Requirements

Bachelor's degree in information systems, cybersecurity, computer science, or a related field; demonstrated equivalent experience may substitute.
Five or more years administering business IT infrastructure, including Windows Server, Microsoft 365 and Entra ID, group policy, and network segmentation.
Experience configuring and supporting remote desktop or virtual desktop environments.
Experience designing and operating a backup program with offline or offsite copies, snapshot replication, and documented restore testing.
Experience managing user access, including account setup, periodic access review, and removal.
Experience writing procedures, policies, or training materials that people outside IT can follow.
A track record of working within a documented security or quality framework in any industry, with the ability to learn and own the firm's requirements.
U.S. citizenship.
Clear written communication and ability to explain procedures in terms that fit staff members' work.

Nice To Haves

Security+, CISSP, CISM, CISA, Microsoft 365 or Azure administrator certification, or a comparable credential.
Experience with government-grade encryption on storage, removable media, and network connections.
Experience with tape libraries, enterprise NAS snapshot replication, and site-to-site VPN.
Experience working with a managed security service provider for logging, monitoring, and vulnerability scanning.
Experience specifying and procuring IT hardware and managing a departmental budget.
Experience protecting large technical datasets and familiarity with software used to process them.
Background in an architecture, engineering, surveying, or construction firm.
Prior exposure to client-mandated security requirements in any role.
Eligibility for a background investigation.
Familiarity with how a technical services firm captures, processes, and delivers large project datasets.

Responsibilities

Serve as the firm's security lead and primary point of contact for the outside auditor during assessment.
Define and document the boundary of the secured environment, including systems, people, facilities, and data flows.
Author and maintain the security plan, open-items list, policies, procedures, and record library documenting safeguards.
Run the audit cycle, including readiness review, gap closure, auditor engagement, and annual confirmation.
Track changes to applicable security requirements and translate them into program updates.
Design, build, and administer the on-premises secured environment for project data and deliverables, including storage, compute, network segmentation, and access control.
Configure and maintain remote desktop or virtual desktop access for project staff working in the secured environment.
Administer the encrypted email and file-sharing platform for controlled communications, including licensing and user setup.
Administer the Microsoft 365 tenant, including identity, multifactor authentication, conditional access, sharing policies, and data loss prevention rules.
Specify and validate encryption standards for storage, removable media, and network connections.
Specify, select, and configure secured-environment servers, storage, networking, and software; plan capacity based on project pipeline and retention needs.
Prepare and manage the security program's annual budget and present it to the CEO for approval.
Maintain the in-scope hardware, software, and license inventory, including lifecycle and replacement planning.
Design and operate backups, including local replication, offline or offsite copies, and periodic restore testing.
Manage removable media end to end, including inventory, labeling, chain-of-custody logs, encrypted transport, and secure wiping or destruction.
Write and maintain standard operating procedures for field data intake, deliverable export, and receipt of client-furnished documents.
Reconcile media and backup logs and report exceptions.
Establish centralized logging and vulnerability scanning for in-scope systems, directly or through a managed security provider, and review results.
Maintain the patch and configuration baseline for in-scope systems.
Own the incident response plan, lead periodic exercises, and manage client incident reporting requirements.
Deliver onboarding and annual security awareness training for in-scope staff, with role-based content for field crews, project teams, and administrators.
Manage user accounts for the secured environment and correspondence platform, including setup, periodic access reviews, and removal.
Advise project managers on data-handling requirements during proposals and project kickoff.
Maintain documented secured-environment procedures and contribute to the firm's IT runbook and disaster recovery plan.
Coordinate changes to the secured environment, its boundary, or data-handling procedures with the IT lead, affected project's contract manager, and project leads.
Report program status candidly, maintain accurate records, report findings with closure plans, and keep those plans current.