Apital is looking for a compliance-focused, detail-oriented GRC Analyst to support cybersecurity governance efforts across CBTC and PTC transit infrastructure projects. They will support ongoing regulatory alignment, vendor assurance, and policy development for critical rail communication and signaling systems. 

The GRC Analyst ensures public rail cybersecurity practices comply with government regulations and internal risk policies, particularly control systems and passenger data. 

Responsibilities

• Conduct internal audits for cybersecurity compliance (e.g., TSA SD02C, FTA rules). 
• Maintain policy documentation related to fare systems, CCTV, and ICS security. 
• Support risk assessments for new IT/OT integrations. 
• Monitor third-party vendor compliance in rail technology deployments. 
• Ensure cybersecurity policies and controls apply to CBTC/PTC communication infrastructure. 
• Review vendor contracts and system specifications for security clauses covering CBTC and PTC components. 
• Track compliance with regulatory standards involving rail control and safety systems (e.g., FRA regulations, TSA SD02C). 
• Maintain risk registers that include cybersecurity risks tied to real-time train control systems. 

Required Skills/ Knowledge

• Familiarity with FTA, TSA, and NIST cybersecurity guidelines for transportation. 
• Strong analytical skills in risk and control documentation. 
• Experience conducting assessments in OT environments. 

Desired Skills/ Knowledge

• Certifications: GIAC (GCIH, GCFA), ECIH, or CISA. 

401K, 401 matching, disability insurance, employee assistance program, flexible spending account, health insurance.