Information Security and Compliance Specialist

Position Overview

Title: Information Security and Compliance Specialist

Reports to: CEO

Location: Lexington, KY (in office), with periodic travel to Nashville, Washington, DC, and client sites

Classification: Full-time, exempt

The Information Security and Compliance Specialist is responsible for the design, implementation, and day-to-day operation of the security program that protects A|S's controlled project data. The role stands up and runs a secured, on-premises data environment for large project datasets, an encrypted channel for client correspondence, the media and backup systems that move and protect that data, and the written policies, records, and training that hold the program together through an outside audit.

The role takes the firm from a designed architecture to an audited, operating program, then keeps it current as clients, staff, and technology change. The role works alongside the firm's IT lead.

The ideal candidate is an experienced systems or security administrator who has run infrastructure, backups, and access control in a business setting and who writes clearly. Direct experience with formal security frameworks is helpful and is something A|S will train for; the firm will fund the training and certification needed to lead the program. Familiarity with how a technical services firm captures, processes, and delivers large project datasets is a strong plus.

Key Responsibilities

Security program ownership

• Serve as the firm's security lead and as the primary point of contact for the outside auditor during assessment
• Define and document the boundary of the secured environment: which systems, people, facilities, and data flows sit inside it
• Author and maintain the security plan, the open-items list, policies, procedures, and the record library that shows each required safeguard is in place
• Run the audit cycle: readiness review, gap closure, auditor engagement, and the annual confirmation that follows
• Track changes to the security requirements the firm follows and translate them into program updates

Secured data environment

• Design, build, and administer the on-premises secured environment that holds project data and deliverables, including storage, compute, network segmentation, and access control
• Configure and maintain the remote access path (remote desktop or virtual desktop) for project staff working inside the environment
• Administer the encrypted email and file-sharing platform used for controlled communications, including licensing and user setup
• Administer the firm's Microsoft 365 tenant, including identity, multifactor authentication, conditional access, sharing policies, and data loss prevention rules that keep controlled data out of the general business environment
• Specify and validate approved encryption standards on storage, removable media, and network connections
• Specify, select, and configure the servers, storage, networking, and software for the secured environment, and plan capacity against project pipeline and retention requirements
• Prepare and manage the annual budget for the security program, including hardware, software, licensing, outside services, and training, and present it to the CEO for approval
• Maintain the asset inventory for in-scope hardware, software, and licenses, including lifecycle and replacement planning

Backup, media, and data handling

• Design and operate the backup program: local replication, offline or offsite copies, and periodic restore testing
• Own removable media end to end: inventory, labeling, chain-of-custody logs for field drives and deliverable drives, encrypted transport, and secure wiping or destruction at end of life
• Write and maintain the standard operating procedures for field data intake, deliverable export, and receipt of client-furnished documents
• Reconcile media and backup logs and report exceptions

Monitoring, logging, and incident response

• Stand up centralized logging and vulnerability scanning for in-scope systems, directly or through a managed security provider, and review results
• Maintain the patch and configuration baseline for in-scope systems
• Own the incident response plan, lead periodic exercises, and manage client incident reporting requirements

People, training, and awareness

• Deliver onboarding and annual security awareness training for in-scope staff, with role-based content for field crews, project teams, and administrators
• Manage user accounts for the secured environment and the correspondence platform: setup, periodic access review, and removal
• Advise project managers on data-handling requirements during proposals and project kickoff

IT continuity

• Maintain documented procedures for the secured environment and contribute to the firm's IT runbook and disaster recovery plan

Success Profile

In the first year, success looks like a defined and documented secured environment with a signed security plan, an operating secured environment that supports controlled project work without workarounds, and an outside audit scheduled with a readiness review the firm is prepared to defend. Backup and media procedures run on schedule, restore tests pass and are documented, and the media log reconciles.

Beyond the first year, the program passes its audit and holds that standing through each annual confirmation, absorbs new projects and staff with routine updates, and generates its records as a byproduct of normal operations. The role provides clear, responsive data-handling guidance to project teams at proposal and kickoff.

The measurable signals: audit requirements met on the first attempt; zero data-handling incidents attributable to process gaps; restore tests completed each quarter; access reviews completed and documented; training completion at full coverage for in-scope staff; and auditor requests answered from the record library.

Qualifications

Required

• Bachelor's degree in information systems, cybersecurity, computer science, or a related field; demonstrated equivalent experience is accepted as a substitute
• Five or more years administering business IT infrastructure, including Windows Server, Microsoft 365 and Entra ID, group policy, and network segmentation
• Experience configuring and supporting remote desktop or virtual desktop environments
• Experience designing and operating a backup program with offline or offsite copies, snapshot replication, and documented restore testing
• Experience managing user access: account setup, periodic access review, and removal
• Experience writing procedures, policies, or training material that people outside IT can follow
• A track record of working within a documented security or quality framework in any industry (for example ISO 27001, SOC 2, HIPAA, PCI, or an internal audit program), with the ability to learn the firm's requirements and own them
• U.S. citizenship

Preferred

• Security+, CISSP, CISM, CISA, Microsoft 365 or Azure administrator certification, or a comparable credential
• Experience with government-grade encryption on storage, removable media, and network connections
• Experience with tape libraries, enterprise NAS snapshot replication, and site-to-site VPN
• Experience working with a managed security service provider for logging, monitoring, and vulnerability scanning
• Experience specifying and procuring IT hardware and managing a departmental budget
• Experience protecting large technical datasets and familiarity with the software used to process them
• Background in an architecture, engineering, surveying, or construction firm
• Prior exposure to client-mandated security requirements, in any role
• Eligibility for a background investigation

Professional Conduct

The role reports program status candidly, including gaps. Records reflect what the systems actually do. Findings are reported when found, with a plan to close them, and the plan is kept current.

The role designs controls with the staff who will use them and explains procedures in terms that fit their work. Changes to the secured environment, its boundary, or data-handling procedures are coordinated with the IT lead, the contract manager on the affected project, and the project leads.

As with each A|S position, the role carries the firm's standards for client service, confidentiality, and respectful conduct toward colleagues, clients, and partners.

Benefits

• 401(k) with company match
• Comprehensive Health, Dental, Vision, and Life Insurance
• Employee Referral Program
• Paid Time Off
• Professional development support, including security training and certification

EEO

Ayoroa Simmons is an equal opportunity employer, and we value diversity. Employment decisions are based on

qualifications, merit, and business need.

Title VI Accreditation

Ayoroa Simmons ensures nondiscrimination in its programs and activities in accordance with Title VI of the Civil Rights Act of 1964 regulation. If you need more information or special assistance for persons with disabilities or limited English proficiency, please contact the Title VI Coordinator: Kim Short at (866) 726-2246.