Cybersecurity & Infrastructure Lead

The Cybersecurity & Infrastructure Lead leads cybersecurity, cloud governance, and compliance implementation across Marquette-Alger RESA and partner districts. Reporting to the Chief Technology Officer (CTO), this role owns the Agency’s security controls across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), ensuring the Agency is prepared to pass its SOC 2, ISO 27001:2022 audits with clean results.

The Lead enforces role-based access control (RBAC), strict access management, and endpoint security across Agency accounts and devices, and establishes clear ownership and accountability for every control. This individual ensures that sensitive and regulated data is handled in alignment with HIPAA, COPPA, FERPA, and governs the security of the Agency’s artificial intelligence and machine learning workloads.

The Lead directly owns the security-critical infrastructure controls tested in audits, including firewalls, vulnerability management, backups, and physical access requirements, and maintains full visibility into Agency systems, configurations, and logs. Day-to-day network and server operations are performed by the Technology Director in accordance with the security requirements set by the Lead.

MINIMUM QUALIFICATIONS: 

• Five (5)+ years of hands-on experience in Information Technology, including cloud security and administration across AWS, Microsoft Azure, and GCP.
• Current professional- or specialty-level certification from at least one of the following cloud providers: AWS (Certified Security - Specialty or Certified Solutions Architect - Professional), Microsoft Azure (Cybersecurity Architect Expert or Azure Solutions Architect Expert), or Google Cloud (Professional Cloud Security Engineer or Professional Cloud Architect).
• Demonstrated experience leading or directly supporting a SOC 2 audit, an ISO 27001 certification, or both.
• Demonstrated ability to establish and enforce security requirements for technical teams, including data scientists, engineers, and architects.
• Hands-on experience with identity and access management, including RBAC, multifactor authentication, and privileged access across Active Directory, Entra ID (Azure), and Google Workspace.
• Hands-on experience managing enterprise firewalls, vulnerability management, and backup systems.
• Working knowledge of HIPAA, COPPA, FERPA, and GDPR as they apply to data handling and cloud storage.
• Self-directed individual with the ability to manage multiple projects simultaneously and meet timelines.
• Demonstrated ability to establish/maintain positive relationships and collaborate/problem solve with diverse partners and stakeholders.
• Excellent interpersonal, verbal, and written communication skills.
• Ability to serve students, staff, and the public pleasantly and efficiently.
• Ability to act in a fair and highly ethical manner and to handle confidential information with discretion.

PREFERRED QUALIFICATIONS:

• Experience governing enterprise AI deployments, including Amazon Bedrock, and a working understanding of deep learning workflows.
• Hands-on experience with core cloud services such as AWS (EC2, S3, IAM, VPC, CloudFront, CloudTrail, KMS), Microsoft Azure (Virtual Machines, Blob Storage, Azure DevOps, Front Door, Key Vault, Defender for Cloud), and Google Cloud (Compute Engine, Cloud Storage, Cloud Shell, Cloud CDN, Cloud IAM, Security Command Center).
• Experience deploying and securing Azure Virtual Desktop or Windows 365 Cloud PC for regulated workloads.
• Experience with a security information and event management (SIEM) platform such as Elastic Cloud or Microsoft Sentinel, and with infrastructure as code (Terraform, AWS CloudFormation, or Azure Bicep).
• Compliance, audit, or privacy certifications such as CISA, CISM, CISSP, CCSP, ISO 27001 Lead Implementer or Lead Auditor, CIPP/E, or CIPM.
• Experience with a compliance automation platform (Vanta preferred) and frameworks such as NIST and the CIS Critical Security Controls.
• Bachelor’s Degree in technology, computer science, computer information systems or related field OR equivalent combination of significant education, training, certifications, and experience.
• Server+, Network+, CCNA, or similar certifications.
• Prior experience in a local school district, ISD, or RESA.

ESSENTIAL DUTIES AND RESPONSIBILITIES:  

• Lead the Agency’s SOC 2, ISO 27001:2022, and GDPR compliance programs, from gap assessment through successful audit.
• Administer AWS, Microsoft Azure, and GCP at the organization level, including account, subscription, and project structure and the guardrail policies applied across them.
• Establish security and compliance controls for the Agency’s enterprise agent platform, Amazon Bedrock, and other AI services, including access approvals, guardrails, and logging.
• Set security standards for data scientists, machine learning engineers, and architects, reviewing and approving system designs against control requirements.
• Design and enforce role-based access control (RBAC) and least-privilege access across cloud platforms, identity providers, and Agency applications.
• Secure cloud compute, storage, content delivery networks, and development pipelines through hardened configurations, encryption, key management, and controlled deployment.
• Design and secure Azure virtual desktop environments for staff who handle HIPAA-protected and other highly sensitive data, ensuring regulated data is not stored on local devices.
• Establish and maintain the Information Security Management System (ISMS) required by ISO 27001:2022, including the Statement of Applicability, risk treatment plan, and internal audits.
• Own firewall configuration and reviews, vulnerability scanning and patch deadlines, and backup systems, including regular restore testing.
• Centralize security logging and monitoring, ensuring visibility and rapid response to potential threats.
• Enforce strict access management, including multifactor authentication, privileged access controls, credential rotation, and periodic access reviews.
• Ensure data and cloud storage are handled in alignment with HIPAA, COPPA, FERPA, and GDPR, including inventory, classification, retention, and deletion.
• Develop, document, and enforce information security policies and procedures in collaboration with the CTO and department leadership.
• Implement, test, and maintain security controls in the Agency’s compliance automation platform (Vanta), ensuring every control has a named owner and failing items are remediated on schedule.
• Define security requirements for systems operated by the Technology Director and verify compliance through review of configurations, logs, and evidence.
• Define device compliance policies and enforce endpoint security standards, including disk encryption, malware protection, screen lock, and patching.
• Conduct the annual risk assessment, maintain the risk register, and assess the security posture of vendors and third parties.
• Collaborate with department leadership on incident response planning, documentation, and procedures.
• Set physical access requirements, approve access levels, and review access records for door access and surveillance systems.
• Prepare and maintain audit evidence, control documentation, and system descriptions, and coordinate auditor requests during examination and certification periods.
• Develop security awareness training content for employees and verify staff completion.
• Maintain professional competence through ongoing education regarding statutes, regulations, and IT standards to ensure the Agency utilizes current best practices.
• Report compliance status, security gaps, and audit risks directly to the CTO.
• Perform other duties as assigned.

SPECIAL CONDITIONS:

• Occasional overnight travel downstate for conferences and activities of professional organizations.
• Must keep the affairs of Marquette-Alger RESA and LEAs confidential at all times.
• Must uphold confidentiality of privileged and sensitive student/staff information.
• May require occasional regional job travel using personal vehicle.

PHYSICAL DEMANDS:

• Regularly required to sit or stand for extended periods; ability to walk, bend, and reach to inspect hardware or network infrastructure.
• Frequent use of hands and fingers to operate computer keyboards and specialized technical tools.
• Occasionally required to lift, carry, or move hardware weighing up to 35 lbs.
• Ability to read technical manuals/monitors and communicate clearly in person or via digital platforms, often in environments with moderate ambient noise (e.g., server rooms).

TERMS OF EMPLOYMENT: Full time; 12-month position; non-union; Must have regular and reliable job attendance, performance, and the physical ability to do the job.

REPORTS TO: Chief Technology Officer.

COMPENSATION: Grade 8 on Marquette-Alger RESA Non-Affiliated Salary Schedule.
 

Marquette-Alger RESA does not discriminate on the basis of race, color, national origin, ethnicity, religion, sex (including gender identity or expression, sexual orientation, pregnancy, childbirth, or a related condition), age, height, weight, familial status, marital status, military service, veteran status, genetic information, disability, or any other legally protected basis, and prohibits unlawful discrimination, including harassment and retaliation, in any education program or activity that it operates, including in admission and employment. Marquette-Alger RESA’s Non-discrimination, Anti-Harassment, and Non-Retaliation Policy, as well as the grievance procedure for reporting concerns or complaints, are available at maresa.org/about-us/notice-of-nondiscrimination.