Cybersecurity Officer (Manager), Lead SOC Automation

at MTA, Inc.
Published June 2, 2023
Location New York, NY
Category Default  
Job Type Full-time  


Cybersecurity Officer (Manager), Lead SOC Automation

Job ID: PS104464

Business Unit: MTA Headquarters

Location: New York, NY, United States


Department: IT Cyber Security

Date Posted: May 5, 2023


Job Information


JOB TITLE: Cybersecurity Officer SOC Automation

SALARY RANGE: $144,450 – 191,000


DEPT/DIV: MTA Information Technology/ Office of IT Cyber Security Services

SUPERVISOR: Cybersecurity Director Monitoring

LOCATION: 2 Broadway, New York, NY 10004

HOURS OF WORK: 9am-530pm (7.5 hours/day)

This position is eligible for telework. New Hires are eligible to apply 30 days after their effective date of hire.



The purpose of this position is to provide technical leadership and management of MTA’s cyber security program in one or more technical domains.

This job is accountable for leading the design, delivery and maintenance of a scalable and optimized SIEM/SOAR solution with the goal of real time threat detection with automated response capabilities. This position will closely collaborate with the SOC, Threat Detection, and Incident Response teams to build high-impact features, identify strategic cyber initiatives, and create automated response and detection processes, and playbooks.

As part of managing the program, the Cybersecurity Officer will need expertise in managing a complex program with highly skilled staff, contracts, and processes associated with risk management that are essential to maintaining electronic and physical safety for MTA’s business in all areas that utilize technology (Corporate, Customer Facing and Informational, Fare Payment/PCI, Operational Technologies, 3rd Party Managed, Vendors, etc.).

The Cybersecurity Officer will be responsible for managing and developing staff, technology, and processes to reduce risk with the evolved cyber threat landscape and changing technology portfolio.




  • Provide leadership to a strong talent pool of technical professionals

  • Provide oversight of day-to-day operations of the SOC Automation and Engineering team toward maturing processes and ensuring uninterrupted service delivery.

  • Be a thought leader in SOC operations - Automation, Orchestration, analytics, and technology management

  • Lead the implementation, integration and maintenance of the Security Orchestration, Automation and Response (SOAR) platform.

  • Manage SIEM(SPLUNK) Administration team and provide guidance as needed to improve data processing efficiency.

  • Oversight of all vendor services delivery related SOC automation and engineering.

  • Management of events/logs collection to SIEM which includes identification and incorporation of all security relevant log sources to facilitate a single pane of glass approach for monitoring alerts.

  • Design, implement and Tune detection rules to reduce false-positives and increase alert fidelity in SOC detection systems (SIEM, UEBA, NIPS/HIPS).

  • Assist SOC, Threat Intelligence, and Incident Response Teams with Cyber-Security engineering tasks.

  • Define and deliver metrics/KPIs (Key Performance Indicators)/SLAs (Service Level Agreements) at the organizational level to measure overall quality and efficiency

  • Lead a team of multi-functional technical staff planning, building, and maintaining cybersecurity tools, configurations and risk mitigation to support Information and Operational Technology applications and/or infrastructure products

  • Provide leadership in development of inter-team communication and cohesiveness; sustain culture and supporting assigned staff during organizational growth/changes.

  • Provide direction on evaluation, selection, implementation, and maintenance of cybersecurity tools, processes, and techniques for their assigned cyber domains and products, ensuring appropriate investment in strategic and operational systems.

  • Define and deliver metrics/KPIs (Key Performance Indicators)/SLAs (Service Level Agreements) at the organizational level to measure overall quality and efficiency

  • Leads teams to complete projects when a project manager has not been assigned.

  • Attain significant achievements managing technical teams, contractors and vendors.

Human Resource Management

  • Attract, develop, coach and retain high-performance team members, empowering them to elevate their level of responsibility, span of control and performance in conjunction with the Cybersecurity Management and IT Workforce Planning & Workload Management office.

  • Build staff expertise and competence to meet evolving demands within the Enterprise Product Management unit.

Financial Management

  • Demonstrate consistent understanding of funding, communications and systems; recommend timelines and resources needed to achieve the program goals.

  • Collaborates with IT Business Management Services to identify procurement contracts to support program related activities.

Strategy & Planning

  • Assesses and makes recommendations on the improvement and re-engineering within the IT Department and work with the stakeholders at keeping the total cost of ownership down.

  • Promote the use of employee self -service and mobile connectivity within products to reduce the reliance of paper.

  • Recommends and supports automation of business process creating in-line forms and approvals, reducing the reliance on manual approvals that could be untimely.

  • Uses judgment to form conclusions that may challenge conventional wisdom

Acquisition & Deployment

  • Coordinates and facilitates consultation with stakeholders to define business and systems requirements for new technology implementations, developing business case and cost justifications for such initiatives.

  • Provides direction on evaluation, selection, implementation and maintenance of information systems, ensuring appropriate investment in strategic and operational systems.

  • Advises MTA IT management, as information becomes available, in the changing trends and emerging technology and their potential use within the MTA.

  • Directs the development of the analysis required to determine if Information Technology projects should follow a “Build” (develop with in-house staff) or “Buy” (cloud or packaged solution) methodology.

  • Manages the development and implementation of new modules within assigned products.

  • Advises on the selection, prioritization, development and implementation on products as they relate to the selection, acquisition, development, and installation of MTA IT and OT Security, applications and infrastructure.

Management and Oversight

  • Participates in overall business planning bringing a current knowledge and future vision of technology and systems as related to the company’s goals.

  • Responsible for leading and reporting on various product progress and deliverables ensuring that the IT/OT needs of the MTA are met on time and within budget, including identifying weekly, monthly and annual performance targets to show progress on IT product work and OT objectives.

  • Ensure continuous delivery of product services through oversight of service level agreements with end users and monitoring of product performance.

  • Responsible for the recruitment, development, motivation, training and retention of a diverse and high performing multi-level IT/OT team professionals, conforming to budgetary objectives and Human Resources policy and programs in conjunction with the IT Workforce Planning & Workload Management office.

  • Develop business case justifications and cost/benefit analyses for IT spending and initiatives keeping customizations to a minimum and total cost of ownership down.

Cybersecurity Officer-Specific Accountabilities


  • Manage and plan the future technical architecture, providing insight into the future of their area of technology in order to continually improve effectiveness and efficiency.

  • Manage and plan the development of roadmaps related to their area(s) of expertise to manage and meet identified technology needs.

  • Manage and plan the evaluation of new technologies relative to their domain(s) to determine applicability to and best meet the needs of MTA and constituent agencies.

  • Manage and ensure disaster recovery and contingency plans for their domain(s) to provide users with minimal interruptions in service.


  • Oversees architectural direction for domains under management to meet senior management and cybersecurity goals.

  • Understand, review, and approve Cybersecurity Reference Architectures and Solutions for applying them

Revalidates systems to most recent reference architectures to determine gaps, develop and manage programs to align systems to newest standards and reference architectures

Contracts/Vendor Management

  • Contribute and own technical elements of RFPs and RFIs and negotiates with vendors on technical issues to ensure results are delivered in line with user and organization requirements.

  • Manages contracts and expenses to ensure SLAs and contract renewals are processed timely

  • Provide contract management support to ensure vendor deliverables are met

  • Manage and lead major projects and assigned service providers with technical expertise to address mission critical issues, evaluates ongoing vendor service level and enforces SLAs and penalties.


  • Ensure detailed and updated documentation is in place for cybersecurity systems and user processes.

  • Participate in the creation of enterprise security documents (policies, standards, baselines, guidelines, and procedures) under the direction of the IT Security Manager, where appropriate.

Guidance, Communications and Training Support

  • Provides timely and relevant updates to appropriate stakeholders and decision makers

  • Communicates investigation findings to relevant business units to help improve the information security posture

  • Provides technical guidance to project managers and senior leadership on cybersecurity and technology strategies

  • Ensure quality and review and guidance on tests of new systems and manage cybersecurity risks and remediation system testing, baseline, and best practices

  • Provide escalation support to project teams in their area of expertise to promote technical understanding and talent development

  • Provide guidance and take input from Analysts, Engineers, Architects and Technology Subject Matter Experts on cybersecurity and technology best practices, current threat landscape, and a risk management approach for optimal alignment

  • Provides sound cybersecurity recommendations


  • Provide leadership and advisement when necessary, during incident response and provide continuous improvement updates to threat model for risks to the business and systems

  • Ensure specific monitoring points are continually updated to assess performance of technologies in their domain(s). Identify and manage the necessary actions to ensure optimal performance and reliability.

Research & Analysis

  • Hypothesizes new threats and indicators of compromise

  • Ensure cybersecurity technology solutions meet strategy meets security framework objectives and business objectives

  • Monitors relevant information sources to stay up to date on current attacks and trends

  • Research emerging technologies and process improvements to stay current and plan for evolving threat landscape to ensure strategy meetings current threats

  • Compiles and analyzes data for management reporting and metrics

  • Validates and maintains incident response plans and processes to address potential threats



  • Must possess a deep understanding of technology and cybersecurity domain principles.

  • Expert knowledge and familiarity with various components of cyber security operations systems and tools.

  • Understanding of SOC, Threat Intelligence, & Incident Response workflows.

  • Expert knowledge of and familiarity with Security applications such as SOAR, SIEM, UEBA, NIPS/HIPS

  • Demonstrated ability to investigate, troubleshoot, lead and support technical issues both remotely and on-site using standard MTA tools and techniques.

  • Knowledge of common IT security management standards and frameworks such as ISO/IEC 27001, NIST 800-53, PCI, and MITRE ATT&CK

  • Knowledge of Domain structures, user authentication and authorization, encryption and networking

  • Experience with escalation, notification, and after-action review processes for security incident management and recovery.

  • Expert knowledge of and familiarity with various components of an information security system, including firewalls, authentication protocols, encryption software, remote access systems, and commercial-off-the-shelf security products.

  • Proven ability to manage projects and initiatives.

  • Proven ability to manage people.

  • Proven ability to add value to a team.

  • Understanding of Operating Systems, Cloud, Mobile, and Applications.

  • Understanding of TCP/IP (OSI Layers 1– 4) and Internet and Intranet technologies required (OSI Layers 5-7) required.

  • Demonstrated ability to provide technical direction to less senior staff members, and to train new lower level staff members that enter the security team.

  • Demonstrated ability to perform research and recommend solutions for security problems to management.

  • Demonstrated ability to plan, design and engineer solutions and projects for the security team.

  • Demonstrated ability to perform project management tasks related to solutions and projects for the security team.

  • Demonstrated ability to be able to lead the planning and coordination of security tasks and activities within the security team.

  • Demonstrated ability to perform all technical and non-technical tasks, such as procurement, while ensuring that security tasks are completed on time and within budget.

  • Must demonstrate highly developed knowledge of current industry standard information security and market trends.

  • Demonstrated ability to plan, present and apply complex technology solutions to solve critical business requirements effectively and efficiently.

  • Proven experience working with senior level staff contributing to both short and long term technology related planning strategies.

  • Successful track record in design of software systems to meet the current and future needs of a complex organization OR successful track record in design and implementation of IT Infrastructure and related hardware and software technologies to meet the current and future needs of a complex transportation organization.

  • Strong Verbal/written communications skills.

  • Financial/budgeting planning and management experience a plus.

  • Ability to fit in with the constant shifting needs and demands of the business Departments.

Education and Experience


  • Bachelor’s Degree in Computer Science or related fields or equivalent experience. An equivalent combination of education and experience may be considered in lieu of degree.

  • CISSP, CISM, or other advanced security-related certification preferred

  • Certifications in technology subdomains preferred (ie. Cloud, Applications, Infrastructure, Security Technology, etc.).

  • A minimum of 4 plus years of relevant experience.

  • Requires prior experience with installing, maintaining and troubleshooting technology systems.

  • Experience in Project Management Principles (Waterfall and Agile) preferred.

Other Information


As an employee of MTA Headquarters, you may be required to complete an annual financial disclosure statement with the State of New York, if your position earns more than $108,638 (this figure is subject to change) per year or if the position is designated as a policy maker

How To Apply


MTA employees must apply via My MTA Portal ( . You can submit an online application by logging into My MTA Portal, clicking the My Job Search ribbon, and selecting the “Careers” link.

Logging in through My MTA Portal will link your BSC ID number to your job application to identify you as an internal applicant.

Equal Employment Opportunity


MTA and its subsidiary and affiliated agencies are Equal Opportunity Employers, including with respect to veteran status and individuals with disabilities.

The MTA encourages qualified applicants from diverse backgrounds, experiences, and abilities, including military service members, to apply.