Cybersecurity Engineer– Administration Division – SF Municipal Transportation Agency (1044)

Company Description

APPOINTMENT TYPE: Temporary Exempt, Category 18: This position is excluded by the Charter from the competitive Civil Service examination process, shall serve at the discretion of the Appointing Officer and are considered to be "at-will" employees. The duration of this appointment shall not exceed 36 months.

Application Opening: July 21, 2026

Deadline to Apply: 11:59PM PST on August 4, 2026

Recruitment ID: TEX-1044-166676

Salary: $171,158 - $215,306 annually

Division: Administration

Section/Unit: Technology Solutions and Integration/ Network Infrastructure

Work Location: One South Van Ness Avenue, 3rd Floor, San Francisco, CA

Work Schedule: Monday – Friday, 8:00am-5:00pm; onsite minimum of 4 days a week. Additionally, afterhours work will be required as needed during evenings or weekends (typically once or twice a month)

How to Apply:

1. Submit Smart Recruiters application by clicking on "I'm Interested"/”Apply Now” and completing the application.

2. Attach cover letter

3. Attach resume

4. Respond to the Microsoft Forms supplemental questionnaire. Link only found here: 

 https://forms.cloud.microsoft/r/HbiPYHNPBN

Job Description

The San Francisco Municipal Transportation Agency (SFMTA) is a department of the City and County of San Francisco responsible for the management of all ground transportation in the City. The SFMTA has oversight over the Municipal Railway public transit (Transit Division or “Muni”), as well as bicycling, paratransit, parking, traffic, walking, and taxis. SFMTA is currently in the process of implementing an upgrade of the technology used to manage light rail operations on the surface and in the subway.

The Train Control Upgrade Project (TCUP) is a multi-year, multimillion dollar project with the goal of replacing the existing train control system onboard vehicles and in the Muni Metro subway with a state-of-the-art radio-based technology. TCUP will expand supervision of trains by the train control system from the subway to the entire surface Muni light rail system. The TCUP vendor contract and installation work will be managed by a project management team within the Transit Division (“Muni”).

Information Technology is at the core of TCUP. SFMTA’s Technology Solutions and Integration (TSI) team will be delivering the technology scope for TCUP.  The role will be supporting delivery of the information technology components.

Success requires significant investments in expanded network infrastructure, data architecture, wireless communication systems, servers, databases, and cybersecurity. Project systems will need data integration with existing enterprise and intelligent transportation systems. Changes need to be baselined, documented, designed, implemented, and tested.

This is an opportunity to work with stakeholders and business units across the SFMTA and take a pivotal step in your career. Your work will impact the lives of all users of our transportation services and infrastructure.

Position Description:

Under the direction of the TCUP Technology Project Manager, the Cybersecurity Engineer works with the team responsible for delivering the network topology, policies, wireless infrastructure, fiber infrastructure, network equipment, security, installation, and testing for the new CBTC system. The Cybersecurity Engineer ensures that communication systems supporting CBTC operations are designed, implemented, and maintained to meet security, resiliency, and regulatory requirements.

Examples of Important and Essential Duties:

• Serve as the lead cybersecurity architect for TCUP, defining the security posture for all networked, wireless, and backhaul train control systems.
• Develop and contribute to redundancy and failover strategies, ensuring network resiliency and availability while aligning with cybersecurity requirements.
• Define and document network policies, including access control, segmentation, QoS, and routing practices, ensuring alignment with cybersecurity principles.
• Assess wireless spectrum usage for security risks, interference vulnerabilities, and resiliency.
• Review and provide security oversight of network architecture, including routing, segmentation (VLANs), and multicast configurations.
• Support the design and configuration of network architecture to ensure support for secure routing, segmentati