Marquette-Alger RESA is hiring a Cybersecurity & Infrastructure Lead to oversee cybersecurity, cloud governance, and compliance implementation across Marquette-Alger RESA and partner districts. Reporting to the Chief Technology Officer, this onsite role is responsible for establishing and operating security controls across AWS, Azure, and GCP, with a focus on readiness for SOC 2 and ISO 27001:2022 audits. The position also supports regulated data handling aligned to HIPAA, COPPA, FERPA, and GDPR, including governance for AI and ML workloads.
Key Responsibilities
- Lead SOC 2, ISO 27001:2022, and GDPR compliance programs, including performing a gap assessment through successful audit outcomes.
- Administer AWS, Microsoft Azure, and GCP at the organization level, including account, subscription, and project structure, plus guardrail policies applied across environments.
- Establish security and compliance controls for the enterprise agent platform Amazon Bedrock and other AI services, including access approvals, guardrails, and logging.
- Set security standards for data scientists, machine learning engineers, and architects, including review and approval of system designs against control requirements.
- Design and enforce RBAC and least-privilege access across cloud platforms, identity providers, and Agency applications.
- Harden cloud compute, storage, content delivery networks, and development pipelines using hardened configurations, encryption, key management, and controlled deployment.
- Design and secure Azure virtual desktop environments for staff handling HIPAA-protected and other highly sensitive data, ensuring regulated data is not stored on local devices.
- Establish and maintain an Information Security Management System (ISMS) for ISO 27001:2022, including the Statement of Applicability, risk treatment plan, and internal audits.
- Own firewall configuration and reviews, vulnerability scanning and patch deadlines, and backup systems including regular restore testing.
- Centralize security logging and monitoring to improve visibility and support rapid response to potential threats.
- Enforce access management practices including multifactor authentication, privileged access controls, credential rotation, and periodic access reviews.
- Ensure data and cloud storage align with HIPAA, COPPA, FERPA, and GDPR through inventory, classification, retention, and deletion.
- Develop, document, and enforce information security policies and procedures in collaboration with the CTO and department leadership.
- Implement, test, and maintain security controls in Vanta, ensuring each control has a named owner and failing items are remediated on schedule.
- Define security requirements for systems operated by the Technology Director and verify compliance through review of configurations, logs, and evidence.
- Define device compliance policies and enforce endpoint standards including disk encryption, malware protection, screen lock, and patching.
- Conduct the annual risk assessment, maintain the risk register, and assess the security posture of vendors and third parties.
- Collaborate with department leadership on incident response planning, documentation, and procedures.
- Set physical access requirements, approve access levels, and review access records for door access and surveillance systems.
- Prepare and maintain audit evidence, control documentation, and system descriptions, and coordinate auditor requests during examination and certification periods.
- Develop security awareness training content and verify employee completion.
- Maintain professional competence through ongoing education related to statutes, regulations, and IT standards to support current best practices.
- Report compliance status, security gaps, and audit risks directly to the CTO.
- Perform other duties as assigned.
Requirements
- Five (5)+ years of hands-on experience in Information Technology, including cloud security and administration across AWS, Microsoft Azure, and GCP.
- Current professional- or specialty-level certification from at least one of:
- AWS: Certified Security - Specialty or Certified Solutions Architect - Professional
- Microsoft Azure: Cybersecurity Architect Expert or Azure Solutions Architect Expert
- Google Cloud: Professional Cloud Security Engineer or Professional Cloud Architect
- Demonstrated experience leading or directly supporting a SOC 2 audit, an ISO 27001 certification, or both.
- Ability to establish and enforce security requirements for technical teams, including data scientists, engineers, and architects.
- Hands-on experience with identity and access management, including RBAC, multifactor authentication, and privileged access across Active Directory, Entra ID (Azure), and Google Workspace.
- Hands-on experience managing enterprise firewalls, vulnerability management, and backup systems.
- Working knowledge of HIPAA, COPPA, FERPA, and GDPR as they apply to data handling and cloud storage.
- Self-directed, able to manage multiple projects simultaneously and meet timelines.
- Ability to build positive relationships and collaborate/problem-solve with diverse partners and stakeholders.
- Excellent interpersonal, verbal, and written communication skills.
- Ability to serve students, staff, and the public pleasantly and efficiently.
- Ability to act in a fair and highly ethical manner and handle confidential information with discretion.
Technologies
AWS, Azure, GCP, SOC 2, ISO 27001:2022, GDPR, HIPAA, COPPA, FERPA, Amazon Bedrock, Active Directory, Entra ID (Azure), Google Workspace, RBAC, multifactor authentication, privileged access, firewalls, vulnerability management, backup systems, ISMS, Vanta, Azure virtual desktop, Windows 365 Cloud PC, SIEM, Elastic Cloud, Microsoft Sentinel, Terraform, AWS CloudFormation, Azure Bicep, Amazon EC2, Amazon S3, Amazon IAM, Amazon VPC, Amazon CloudFront, Amazon CloudTrail, Amazon KMS, Azure Virtual Machines, Blob Storage, Azure DevOps, Front Door, Key Vault, Defender for Cloud, Google Compute Engine, Google Cloud Storage, Cloud Shell, Cloud CDN, Cloud IAM, Security Command Center, disk encryption, malware protection, screen lock, patching, Statement of Applicability, risk treatment plan, risk register.
Location and Scheduling
- Location: Marquette, MI (onsite)
- Work arrangement: Full-time, in-person; remote work not available
- Application deadline: 3:00 p.m., Monday, November 23rd, 2026
- Reports to: Chief Technology Officer
Terms of Employment and Compensation
- Employment: Full time, 12-month position, non-union
- Compensation: Grade 8 on Marquette-Alger RESA Non-Affiliated Salary Schedule
- Salary range: USD 93,917 - 115,506 per yearly
Additional Notes and Special Conditions
- Occasional overnight travel downstate for conferences and professional organization activities.
- Keep Marquette-Alger RESA and LEAs affairs confidential at all times, including confidential student/staff information.
- May require occasional regional job travel using a personal vehicle.
- Physical demands include sitting or standing for extended periods, using hands and fingers for technical work, occasionally lifting up to 35 lbs, and reading technical monitors/manuals in environments with moderate ambient noise.
Preferred Qualifications
- Experience governing enterprise AI deployments, including Amazon Bedrock, and a working understanding of deep learning workflows.
- Hands-on experience with core cloud services including AWS (EC2, S3, IAM, VPC, CloudFront, CloudTrail, KMS), Microsoft Azure (Virtual Machines, Blob Storage, Azure DevOps, Front Door, Key Vault, Defender for Cloud), and Google Cloud (Compute Engine, Cloud Storage, Cloud Shell, Cloud CDN, Cloud IAM, Security Command Center).
- Experience deploying and securing Azure Virtual Desktop or Windows 365 Cloud PC for regulated workloads.
- Experience with SIEM platforms such as Elastic Cloud or Microsoft Sentinel, and with infrastructure as code (Terraform, AWS CloudFormation, or Azure Bicep).
- Compliance, audit, or privacy certifications including CISA, CISM, CISSP, CCSP, ISO 27001 Lead Implementer or Lead Auditor, CIPP/E, or CIPM.
- Experience with compliance automation platforms (Vanta preferred) and frameworks such as NIST and the CIS Critical Security Controls.
- Bachelor’s degree in technology, computer science, computer information systems or related field, or equivalent combination of significant education, training, certifications, and experience.
- Server+, Network+, CCNA, or similar certifications.
- Prior experience in a local school district, ISD, or RESA.
