Cybersecurity Engineer– Administration Division – SF Municipal Transportation Agency (1044)

APPOINTMENT TYPE : Temporary Exempt, Category 18:  This position is excluded by the Charter from the competitive Civil Service examination process, shall serve at the discretion of the Appointing Officer and are considered to be "at-will" employees. The duration of this appointment shall not exceed 36 months. Application Opening: July 21, 2026 Deadline to Apply: 11:59PM PST on August 4, 2026 Recruitment ID: TEX-1044-166676 Salary: $171,158 - $215,306 annually Division: Administration Section/Unit: Technology Solutions and Integration/ Network Infrastructure Work Location: One South Van Ness Avenue, 3rd Floor, San Francisco, CA Work Schedule: Monday – Friday, 8:00am-5:00pm; onsite minimum of 4 days a week. Additionally, afterhours work will be required as needed during evenings or weekends (typically once or twice a month) How to Apply: 1. Submit Smart Recruiters application by clicking on "I'm Interested"/”Apply Now” and completing the application. 2. Attach cover letter 3. Attach resume 4. Respond to the Microsoft Forms supplemental questionnaire. Link only found here:    https://forms.cloud.microsoft/r/HbiPYHNPBN The San Francisco Municipal Transportation Agency (SFMTA) is a department of the City and County of San Francisco responsible for the management of all ground transportation in the City. The SFMTA has oversight over the Municipal Railway public transit (Transit Division or “Muni”), as well as bicycling, paratransit, parking, traffic, walking, and taxis. SFMTA is currently in the process of implementing an upgrade of the technology used to manage light rail operations on the surface and in the subway. The Train Control Upgrade Project (TCUP) is a multi-year, multimillion dollar project with the goal of replacing the existing train control system onboard vehicles and in the Muni Metro subway with a state-of-the-art radio-based technology. TCUP will expand supervision of trains by the train control system from the subway to the entire surface Muni light rail system. The TCUP vendor contract and installation work will be managed by a project management team within the Transit Division (“Muni”). Information Technology is at the core of TCUP. SFMTA’s Technology Solutions and Integration (TSI) team will be delivering the technology scope for TCUP.  The role will be supporting delivery of the information technology components. Success requires significant investments in expanded network infrastructure, data architecture, wireless communication systems, servers, databases, and cybersecurity. Project systems will need data integration with existing enterprise and intelligent transportation systems. Changes need to be baselined, documented, designed, implemented, and tested. This is an opportunity to work with stakeholders and business units across the SFMTA and take a pivotal step in your career. Your work will impact the lives of all users of our transportation services and infrastructure. Position Description: Under the direction of the TCUP Technology Project Manager, the Cybersecurity Engineer works with the team responsible for delivering the network topology, policies, wireless infrastructure, fiber infrastructure, network equipment, security, installation, and testing for the new CBTC system. The Cybersecurity Engineer ensures that communication systems supporting CBTC operations are designed, implemented, and maintained to meet security, resiliency, and regulatory requirements. Examples of Important and Essential Duties: Serve as the lead cybersecurity architect for TCUP, defining the security posture for all networked, wireless, and backhaul train control systems. Develop and contribute to redundancy and failover strategies, ensuring network resiliency and availability while aligning with cybersecurity requirements. Define and document network policies, including access control, segmentation, QoS, and routing practices, ensuring alignment with cybersecurity principles. Assess wireless spectrum usage for security risks, interference vulnerabilities, and resiliency. Review and provide security oversight of network architecture, including routing, segmentation (VLANs), and multicast configurations. Support the design and configuration of network architecture to ensure support for secure routing, segmentation (VLANs), and multicast communications. Define security standards for hardware lifecycle management and support lifecycle planning decisions. Implement cybersecurity measures, such as firewalls, intrusion detection/prevention systems (IDS/IPS), and endpoint protection. Conduct periodic vulnerability assessments and ensure compliance with industry standards (e.g., NIST, CISA, ISO/IEC 27001). Validate cybersecurity controls in end-to-end communication systems supporting train control operations. Troubleshoot and resolve issues identified during testing phases. Develop and maintain technical documentation for network and cybersecurity architectures, configurations, and operational procedures. Ensure cybersecurity controls align with applicable railway safety and security standards and regulatory requirements. Define requirements for network and security monitoring and ensure integration with enterprise SOC/NOC tools. Performs other related duties as assigned. Minimum Qualifications: Education: An associate degree in computer science, computer engineering, information systems, or a closely related field from an accredited college or university OR its equivalent in terms of total course credits/units [i.e., at least sixty (60) semester or ninety (90) quarter credits/units with a minimum of twenty (20) semester or thirty (30) quarter credits/units in one of the fields above or a closely-related field]. Experience: Five (5) years of experience analyzing, installing, configuring, enhancing, and/or maintaining the components of a system or platform. Substitution: One year of additional experience as described above may be substitut