Information Security and Compliance Specialist

Ayoroa Simmons LLC • Lexington, KY

5d • Onsite

About The Position

The Information Security and Compliance Specialist designs, implements, and operates the security program protecting A|S's controlled project data. The role establishes and administers a secured, on-premises environment for large project datasets; encrypted client communications; data media and backup systems; and the policies, records, and training needed to support an outside audit. The specialist takes the program from architecture through audit and ongoing operation, keeping it current as clients, staff, and technology change. The position works alongside the firm's IT lead and reports to the CEO. It is based in the Lexington, Kentucky office, with periodic travel to Nashville, Washington, DC, and client sites. The position is full-time and exempt.

The ideal candidate is an experienced systems or security administrator who has administered business infrastructure, backups, and access controls, and who can write clearly. Direct experience with formal security frameworks is helpful; A|S will provide and fund the training and certification needed to lead the program. Familiarity with how a technical services firm captures, processes, and delivers large project datasets is a strong plus.

Success in the first year means establishing and documenting the secured environment, obtaining a signed security plan, operating the environment for controlled project work without workarounds, and scheduling an outside audit with the firm prepared for its readiness review. Backup and media procedures should run on schedule, restore tests should pass and be documented, and media records should reconcile. Longer-term success includes passing the audit and maintaining that standing through annual confirmations, accommodating projects and staff through routine updates, and producing records through normal operations. The specialist also provides timely, clear data-handling guidance to project teams during proposals and kickoff. Measures include meeting audit requirements on the first attempt, avoiding process-gap-related data-handling incidents, completing quarterly restore tests and documented access reviews, achieving full training coverage for in-scope staff, and answering auditor requests using the record library.

Requirements

• Bachelor's degree in information systems, cybersecurity, computer science, or a related field; demonstrated equivalent experience may substitute.
• At least five years administering business IT infrastructure, including Windows Server, Microsoft 365 and Entra ID, group policy, and network segmentation.
• Experience configuring and supporting remote desktop or virtual desktop environments.
• Experience designing and operating a backup program with offline or offsite copies, snapshot replication, and documented restore testing.
• Experience managing user access, including account setup, periodic access review, and removal.
• Experience writing procedures, policies, or training materials that people outside IT can follow.
• A track record of working within a documented security or quality framework in any industry, such as ISO 27001, SOC 2, HIPAA, PCI, or an internal audit program, and ability to learn and own the firm's requirements.
• U.S. citizenship.

Nice To Haves

• Security+, CISSP, CISM, CISA, Microsoft 365 or Azure administrator certification, or a comparable credential.
• Experience with government-grade encryption for storage, removable media, and network connections.
• Experience with tape libraries, enterprise NAS snapshot replication, and site-to-site VPN.
• Experience working with a managed security service provider for logging, monitoring, and vulnerability scanning.
• Experience specifying and procuring IT hardware and managing a departmental budget.
• Experience protecting large technical datasets and familiarity with software used to process them.
• Background in an architecture, engineering, surveying, or construction firm.
• Prior exposure to client-mandated security requirements in any role.
• Eligibility for a background investigation.

Responsibilities

• Serve as the firm's security lead and primary contact for the outside auditor during assessments.
• Define and document the secured-environment boundary, including applicable systems, people, facilities, and data flows.
• Author and maintain the security plan, open-items list, policies, procedures, and records demonstrating that safeguards are in place.
• Run audit readiness reviews, close gaps, engage with the auditor, and manage annual confirmations.
• Track changes to applicable security requirements and translate them into program updates.
• Design, build, and administer the on-premises secured environment for project data and deliverables, including storage, compute, network segmentation, and access control.
• Configure and maintain remote desktop or virtual desktop access for project staff working in the secured environment.
• Administer the encrypted email and file-sharing platform for controlled communications, including licensing and user setup.
• Administer the Microsoft 365 tenant, including identity, multifactor authentication, conditional access, sharing policies, and data loss prevention rules.
• Specify and validate encryption standards for storage, removable media, and network connections.
• Select and configure servers, storage, networking, and software for the secured environment, and plan capacity based on project pipeline and retention requirements.
• Prepare and manage the annual security-program budget covering hardware, software, licensing, outside services, and training, and present it to the CEO for approval.
• Maintain the in-scope hardware, software, and license inventory, including lifecycle and replacement planning.
• Design and operate backups, including local replication, offline or offsite copies, and periodic restore tests.
• Manage removable media end to end, including inventory, labeling, chain-of-custody logs, encrypted transport, and secure wiping or destruction.
• Write and maintain procedures for field data intake, deliverable export, and receipt of client-furnished documents.
• Reconcile media and backup logs and report exceptions.
• Establish centralized logging and vulnerability scanning for in-scope systems, directly or through a managed security provider, and review results.
• Maintain patching and configuration baselines for in-scope systems.
• Own the incident response plan, lead periodic exercises, and manage client incident-reporting requirements.
• Deliver onboarding and annual security-awareness training for in-scope staff, with role-based content for field crews, project teams, and administrators.
• Manage user accounts for the secured environment and correspondence platform, including setup, periodic access reviews, and removal.
• Advise project managers on data-handling requirements during proposals and project kickoff.
• Maintain documented procedures for the secured environment and contribute to the firm's IT runbook and disaster recovery plan.
• Report program status candidly, including gaps; ensure records reflect actual system operation; report findings with current closure plans; and coordinate changes with the IT lead, affected project's contract manager, and project leads.
• Design controls with the staff who use them and explain procedures in terms appropriate to their work; uphold the firm's standards for client service, confidentiality, and respectful conduct.

Benefits

• 401(k) with company match.
• Comprehensive health, dental, vision, and life insurance.
• Employee referral program.
• Paid time off.
• Professional development support, including security training and certification.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level