Principal Cybersecurity Systems Security Officer - 90307947 - null

Your success is a train ride away!

As we move America’s workforce toward the future, Amtrak connects businesses and communities across the country. We employ more than 20,000 diverse, energetic professionals in a variety of career fields throughout the United States. The safety of our passengers, our employees, the public and our operating environment is our priority, and the success of our railroad is due to our employees.

Are you ready to join our team?

Our values of ‘Do the Right Thing, Excel Together and Put Customers First’ are at the heart of what matters most to us, and our Core Capabilities, ‘Building Trust, Accountability, Effective Communication, Customer Focus, and Proactive Safety & Security’ are what every employee needs to know and do to be most impactful at Amtrak. By living the Amtrak values, focusing on our capabilities, and actively embracing and fostering diverse ideas, backgrounds, and perspectives, together we will honor our past and make Amtrak a company of the future.

The Principal Cybersecurity Systems Security Officer leads the cybersecurity governance and risk management program for assigned systems and services, ensuring they operate at an acceptable level of risk and remain assessment- and audit-ready. This role establishes security governance, drives control effectiveness, and integrates security requirements into system design, engineering, operations, and sustainment activities. Oversees continuous monitoring, assessment readiness, and remediation execution, translating control gaps into clear risk decisions and prioritized actions. The role manages and develops cybersecurity staff and partners closely with engineering, operations, compliance, and business leadership to deliver measurable risk reduction while supporting availability, reliability, and operational objectives.

Essential Functions:

• Develop and maintain security documentation, including System Security Plans (SSPs), Security Design Reviews, Secure Design Directives (SDDs), risk assessments, exception requests, and remediation plans.
• Serve as the primary cybersecurity advisor for Agile Release Trains (ARTs), partnering with business, portfolio, product, architecture, and engineering stakeholders to integrate security-by-design principles, DevSecOps practices, and risk management activities into Program Increment (PI) Planning and solution delivery processes.
• Perform security architecture and design reviews to identify security gaps, evaluate risks, and design appropriate mitigating and compensating controls.
• Lead assessment, audit, and assurance readiness activities by establishing evidence strategies, maintaining high-quality security documentation, coordinating reviews, and ensuring timely closure of findings and gaps.
• Drive security assessment and authorization or attestation activities by ensuring security plans, control implementations, and decision artifacts are current, traceable, and defensible.
• Drive continuous monitoring programs by defining required security telemetry, reviewing control health, overseeing vulnerability and configuration management activities, and monitoring residual risk trends.
• Lead risk decision-making by prioritizing remediation activities, adjudicating exceptions and compensating controls, and escalating material risks with clear impact statements and recommended actions.    
• Partner with engineering, architecture, and operations stakeholders to integrate security requirements into system design, change management, release readiness, and lifecycle sustainment processes.

Minimum Qualifications:

• Bachelor’s Degree or equivalent combination of education, training and/or relevant experience.
• 7 years of relevant work experience or 11 plus years in lieu of degree
• ISC2 CISSP (Certified Information Systems Security Professional)

Preferred Qualifications:

• Bachelor’s Degree in Cybersecurity, Information Systems or equivalent combination of education, training and/or relevant experience. Plus 9 years of relevant work experience.
• Desired industry standard cybersecurity certifications: CISM, CISA, CRISC, GCIH, GPEN, CEH, CHFI, Security+, CASP, OSCP, etc.

Knowledge, Skills & Abilities: 

• Ability to build cross-functional alignment and lead complex cross functional programs.
• Strong written and verbal communication skills
• Ability to translate technical findings and regulatory requirements.
• Demonstrated experience performing security architecture reviews, risk assessments, threat modeling, vulnerability management, and security control evaluations across applications, infrastructure, networks, and cloud environments.
• Demonstrated success building or scaling an ISSO/ISSM operating model across multiple products, platforms, or business units.
• Expert knowledge of cybersecurity governance, risk management, and control frameworks, including mapping requirements to implemented controls and measurable evidence.
• Skill in designing and operating continuous monitoring programs (security telemetry, vulnerability management, configuration baselines, exception handling, and metrics).
• Skill in leading audit/assurance activities, including preparing control narratives, evidence packages, and stakeholder responses under tight deadlines.
• Experience implementing or operating an ISO/IEC 27001-aligned information security management system (ISMS) and supporting external audits/attestations.
• Strong knowledge of cybersecurity frameworks and standards, including NIST RMF, NIST CSF, CIS Controls, UCF, and other applicable industry and regulatory frameworks.
• Knowledge of OT/ICS cybersecurity principles, including cyber-to-physical risk, safety impacts, and operational constraints that affect control selection and implementation.
• Experience with GRC tooling (controls library management, evidence workflows, risk registers) and security KPI/KRI design.
• Experience coordinating third-party risk and contract security requirements, including cloud/SaaS and managed service providers.

The salary/hourly range is $113,200.00 – $146,664.00. Pay is based on several factors including but not limited to education, work experience, certifications, etc. Depending on an employee’s assigned worksite or location, Amtrak may consider a geo-pay differential to be applied to the employee’s base salary. Amtrak may offer additional incentive and pay programs to recognize and reward our employees, including a short-term incentive bonus based upon factors such as individual and company performance that is commensurate with the level of the position. 

Learn more about our benefits offerings here.

Requisition ID:167049

Work Arrangement:02-Remote Optional Click here for more information about work arrangements at Amtrak.
Relocation Offered:No
Travel Requirements:0 - 5%

You power our progress through your performance.

We want your work at Amtrak to be more than a job. We want your career at Amtrak to be a fulfilling experience where you find challenging work, rewarding opportunities, respect among colleagues, and attractive compensation. Amtrak maintains a culture that values high performance and recognizes individual employee contributions.

Amtrak is committed to a safe workplace free of drugs and alcohol. All Amtrak positions requires a pre-employment background check that includes prior employment verification, a criminal history check and a pre-employment drug screen.

Candidates who test positive for marijuana will be disqualified, regardless of any state or local statute, ordinance, regulation, or other law that legalizes or decriminalizes the use or possession of marijuana, whether for medical, recreational, or other use. Amtrak's pre-employment drug testing program is administered in accordance with DOT regulations and applicable law.

In accordance with DOT regulations (49 CFR § 40.25), Amtrak is required to obtain prior drug and alcohol testing records for applicants/employees intending to perform safety-sensitive duties for covered Department of Transportation positions. If an applicant/employee refuses to provide written consent for Amtrak to obtain these records, the individual will not be permitted to perform safety-sensitive functions.

In accordance with federal law governing security checks of covered individuals for providers of public transportation (Title 6 U.S.C. §1143), Amtrak is required to screen applicants for any permanent or interim disqualifying criminal offenses.

Note that any education requirement listed above may be deemed satisfied if you have an equivalent combination of education, training and experience.

Amtrak is an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race/color, to include traits historically associated with race, including but not limited to, hair texture and hairstyles such as braids, locks and twists, religion, sex (including pregnancy, childbirth and related conditions, such as lactation), national origin/ethnicity, disability (intellectual, mental and physical), veteran status, marital status, ancestry, sexual orientation, gender identity and gender expression, genetic information, citizenship or any other personal characteristics protected by law.