Senior IT Security Engineer

INIT Innovations in Transportation, Inc.•Chesapeake, VA

9h•$125,000 - $150,000•Hybrid

About The Position

INIT is seeking a Senior IT Security Engineer to drive security controls, security operations and GRC activities across INIT's internal corporate infrastructure and customer-facing transit technology deployments. This role contributes to the security architecture, security operations and control framework across PCI DSS, SOC 2, and ISO 27001. The Senior IT Security Engineer works closely with the IT Security Administrator, IT Operations, and IT Systems Engineering teams, and reports to the Director of IT.

Requirements

10+ years of experience in information security, risk management, or compliance, with increasing responsibility.
Proven experience establishing and directing information security strategy, governance, and risk management programs.
Security-relevant certification required, such as CISSP, CISM, CISA, or CRISC, or actively pursuing one.
Experience implementing, assessing, or designing systems within PCI DSS, SOC 2, ISO 27001, or NIST 800-53 frameworks.
Experience serving as incident commander or leading incident response efforts.
Proven ability to communicate security posture, risk, and compliance status to senior management and external stakeholders.
Strong leadership, problem-solving, and critical thinking abilities.
Ability to work collaboratively across IT Operations, IT Systems Engineering, and software development teams.

Nice To Haves

CISSP, CISM, CISA, or CRISC certification held, rather than in progress.
Experience directing GRC programs or serving as the primary point of contact for external auditors and QSAs.
Experience mapping controls across multiple compliance frameworks, including PCI DSS, SOC 2, and ISO 27001.
Experience owning an enterprise incident response and tabletop exercise program.
Familiarity with cloud security architecture in Microsoft Azure and modern security tooling such as Cloudflare, Arctic Wolf, and Tenable.
Experience in the transportation, transit, or critical infrastructure sector.

Responsibilities

Establish security vision, strategy, and roadmaps with the Director of IT, encompassing internal programs and customer-facing security commitments.
Direct the selection and lifecycle of security tools, architectures, and infrastructure security direction across the organization.
Establish identity, access, and security hardening standards, including Conditional Access, privileged access, and CIS benchmark requirements, for implementation across the environment.
Evaluate security requirements and architecture for customer projects and proposals, identifying gaps, strategies, and budgets needed to meet requirements, and make final decisions on customer project security architecture.
Identify strategic trends affecting the company's security posture and customer trust.
Evaluate and guide secure adoption of AI tools and platforms across IT and business functions, balancing productivity gains against data protection, compliance, and vendor risk.
Serve as incident commander or alternate incident commander during security incidents.
Direct threat intelligence efforts, monitoring emerging threats, vulnerabilities, and attacker techniques relevant to the transit technology industry, and translating findings into operational and architectural changes.
Lead the tabletop exercise program, setting cadence, scope, and participation across technical and business stakeholders, and direct post-exercise and post-incident retrospectives that translate findings into playbook and control updates.
Communicate security posture, risk exposure, and incident status to senior management and, as needed, to customers.
Oversee operational security strategy across customer projects, including contractual security and compliance obligations.
Direct the organization's risk management program, identifying, assessing, and prioritizing information security risks and recommending treatment strategies to leadership.
Establish and maintain the security control framework mapping across PCI DSS, SOC 2, and ISO 27001, ensuring controls satisfy overlapping framework requirements.
Serve as the primary point of contact for external auditors and assessors during compliance audits and certification cycles, and direct remediation of audit findings and gap assessment outcomes.
Evaluate new regulatory and contractual requirements and translate them into control requirements.
Set direction for the organization's security policy suite, leading the creation, review, and revision of information security policies and procedures.
Lead third-party vendor security risk management, directing vendor risk assessments, critical vendor classification, and ongoing monitoring of vendor compliance obligations.
Direct the security awareness and training program, setting curriculum priorities, campaign cadence, and risk-based focus areas for the organization.
Set risk-based prioritization standards for the vulnerability management program and review remediation trends against risk tolerance.

Benefits

Competitive paid time off, starting with 15 days of vacation, increasing with tenure, plus 11 paid holidays, a personal day, and a community service day
6 paid sick days annually
Paid parental leave
100% employer-paid health and dental insurance for employees, with generous dependent coverage contributions
401(k) with company match (currently dollar-for-dollar up to 5% of salary)
Company-paid life insurance, plus short-term and long-term disability insurance
Flexible Spending Accounts (medical, dependent care, and limited FSA options) with employer contributions for eligible medical plans
Annual benefit allowance for optional employee benefits
Continuing education assistance and support for professional development
Optional benefits including accident insurance, legal services, identity theft protection, adoption assistance, education assistance, and student loan repayment assistance