Cybersecurity Engineer– Administration Division – SF Municipal Transportation Agency (1044)

The San Francisco Municipal Transportation Agency (SFMTA) is a department of the City and County of San Francisco responsible for the management of all ground transportation in the City. The SFMTA has oversight over the Municipal Railway public transit (Transit Division or “Muni”), as well as bicycling, paratransit, parking, traffic, walking, and taxis.

SFMTA is currently in the process of implementing an upgrade of the technology used to manage light rail operations on the surface and in the subway.

The Train Control Upgrade Project (TCUP) is a multi-year, multimillion dollar project with the goal of replacing the existing train control system onboard vehicles and in the Muni Metro subway with a state-of-the-art radio-based technology. TCUP will expand supervision of trains by the train control system from the subway to the entire surface Muni light rail system.

The TCUP vendor contract and installation work will be managed by a project management team within the Transit Division (“Muni”).

Information Technology is at the core of TCUP. SFMTA’s Technology Solutions and Integration (TSI) team will be delivering the technology scope for TCUP. The role will be supporting delivery of the information technology components.

Success requires significant investments in expanded network infrastructure, data architecture, wireless communication systems, servers, databases, and cybersecurity. Project systems will need data integration with existing enterprise and intelligent transportation systems. Changes need to be baselined, documented, designed, implemented, and tested.

This is an opportunity to work with stakeholders and business units across the SFMTA and take a pivotal step in your career. Your work will impact the lives of all users of our transportation services and infrastructure.

Position Description

Under the direction of the TCUP Technology Project Manager, the Cybersecurity Engineer works with the team responsible for delivering the network topology, policies, wireless infrastructure, fiber infrastructure, network equipment, security, installation, and testing for the new CBTC system.

The Cybersecurity Engineer ensures that communication systems supporting CBTC operations are designed, implemented, and maintained to meet security, resiliency, and regulatory requirements.

Examples of Important and Essential Duties

• Serve as the lead cybersecurity architect for TCUP, defining the security posture for all networked, wireless, and backhaul train control systems.
• Develop and contribute to redundancy and failover strategies, ensuring network resiliency and availability while aligning with cybersecurity requirements.
• Define and document network policies, including access control, segmentation, QoS, and routing practices, ensuring alignment with cybersecurity principles.
• Assess wireless spectrum usage for security risks, interference vulnerabilities, and resiliency.
• Review and provide security oversight of network architecture, including routing, segmentation (VLANs), and multicast configurations.
• Support the design and configuration of network architecture to ensure support for secure routing, segmentation (VLANs), and multicast communications.
• Define security standards for hardware lifecycle management and support lifecycle planning decisions.
• Implement cybersecurity measures, such as firewalls, intrusion detection/prevention systems (IDS/IPS), and endpoint protection.
• Conduct periodic vulnerability assessments and ensure compliance with industry standards (e.g., NIST, CISA, ISO/IEC 27001).
• Validate cybersecurity controls in end-to-end communication systems supporting train control operations.
• Troubleshoot and resolve issues identified during testing phases.
• Develop and maintain technical documentation for network and cybersecurity architectures, configurations, and operational procedures.
• Ensure cybersecurity controls align with applicable railway safety and security standards and regulatory requirements.
• Define requirements for network and security monitoring and ensure integration with enterprise SOC/NOC tools.
• Performs other related duties as assigned.