Information Security and Compliance Specialist

Information Security And Compliance SpecialistThe Information Security And Compliance Specialist is responsible for the design, implementation, and day-to-day operation of the security program that protects A|S's controlled project data. The role stands up and runs a secured, on-premises data environment for large project datasets, an encrypted channel for client correspondence, the media and backup systems that move and protect that data, and the written policies, records, and training that hold the program together through an outside audit.The role takes the firm from a designed architecture to an audited, operating program, then keeps it current as clients, staff, and technology change. The role works alongside the firm's IT lead.The ideal candidate is an experienced systems or security administrator who has run infrastructure, backups, and access control in a business setting and who writes clearly. Direct experience with formal security frameworks is helpful and is something A|S will train for; the firm will fund the training and certification needed to lead the program. Familiarity with how a technical services firm captures, processes, and delivers large project datasets is a strong plus.Key ResponsibilitiesSecurity program ownershipSecured data environmentBackup, media, and data handlingMonitoring, logging, and incident responsePeople, training, and awarenessIT continuitySuccess ProfileIn the first year, success looks like a defined and documented secured environment with a signed security plan, an operating secured environment that supports controlled project work without workarounds, and an outside audit scheduled with a readiness review the firm is prepared to defend. Backup and media procedures run on schedule, restore tests pass and are documented, and the media log reconciles.Beyond the first year, the program passes its audit and holds that standing through each annual confirmation, absorbs new projects and staff with routine updates, and generates its records as a byproduct of normal operations. The role provides clear, responsive data-handling guidance to project teams at proposal and kickoff.The measurable signals: audit requirements met on the first attempt; zero data-handling incidents attributable to process gaps; restore tests completed each quarter; access reviews completed and documented; training completion at full coverage for in-scope staff; and auditor requests answered from the record library.QualificationsRequiredBachelor's degree in information systems, cybersecurity, computer science, or a related field; demonstrated equivalent experience is accepted as a substituteFive or more years administering business IT infrastructure, including Windows Server, Microsoft 365 and Entra ID, group policy, and network segmentationExperience configuring and supporting remote desktop or virtual desktop environmentsExperience designing and operating a backup program with offline or offsite copies, snapshot replication, and documented restore testingExperience managing user access: account setup, periodic access review, and removalExperience writing procedures, policies, or training material that people outside IT can followA track record of working within a documented security or quality framework in any industry (for example ISO 27001, SOC 2, HIPAA, PCI, or an internal audit program), with the ability to learn the firm's requirements and own themU.S. citizenshipPreferredSecurity+, CISSP, CISM, CISA, Microsoft 365 or Azure administrator certification, or a comparable credentialExperience with government-grade encryption on storage, removable media, and network connectionsExperience with tape libraries, enterprise NAS snapshot replication, and site-to-site VPNExperience working with a managed security service provider for logging, monitoring, and vulnerability scanningExperience specifying and procuring IT hardware and managing a departmental budgetExperience protecting large technical datasets and familiarity with the software used to process themBackground in an architecture, engineering, surveying, or construction firmPrior exposure to client-mandated security requirements, in any roleEligibility for a background investigationProfessional ConductThe role reports program status candidly, including gaps. Records reflect what the systems actually do. Findings are reported when found, with a plan to close them, and the plan is kept current.The role designs controls with the staff who will use them and explains procedures in terms that fit their work. Changes to the secured environment, its boundary, or data-handling procedures are coordinated with the IT lead, the contract manager on the affected project, and the project leads.As with each A|S position, the role carries the firm's standards for client service, confidentiality, and respectful conduct toward colleagues, clients, and partners.Benefits401(k) with company matchComprehensive Health, Dental, Vision, and Life InsuranceEmployee Referral ProgramPaid Time OffProfessional development support, including security training and certificationHOW TO APPLYTo apply, submit a resume and a letter of interest describing your relevant experience and your interest in the role. Applications without a letter of interest will be considered incomplete.EEOAyoroa Simmons is an equal opportunity employer, and we value diversity. Employment decisions are based on qualifications, merit, and business need.Title VI AccreditationAyoroa Simmons ensures nondiscrimination in its programs and activities in accordance with Title VI of the Civil Rights Act of 1964 regulation. If you need more information or special assistance for persons with disabilities or limited English proficiency, please contact the Title VI Coordinator: Kim Short at View phone number on click.appcast.io.