Cybersecurity Analyst III (Senior Cybersecurity Incident Response Team (CIRT) Threat Analyst/Researcher)

Job Title
Cybersecurity Analyst III (Senior Cybersecurity Incident Response Team (CIRT) Threat Analyst/Researcher)
Job Number
00032491

Job Posting:  

#00032491   

Opened:   

04/24/2023

Closes:  

Open Until Filled

Position Title:    

Cybersecurity Analyst III / (Senior Cybersecurity Incident Response Team (CIRT) Threat Analyst/Researcher) 

Class/Group:

0324/B29

Military Occupation Specialty Code:

Army-17C, 25D, 26A, 26B, 26Z; Navy-IS, 683X; Coast Guard-IS, CYB10, CYB11, CYB12, CYB13, CYB14; Marine Corps-0631, 0639, 0679, 0605; Air Force-3D0X2, 3D1X1, 14NX       

FLSA:   

Exempt 

Number of Vacancies:

1

Division/Section:

Office of the Chief Information Security Officer/Security Operations

Salary Range:

$7699.17-$7916.67 / Monthly

Duration:

Regular

Hours Worked Weekly:     

40

Work Schedule:

This position may be eligible for flexible work hours and/or a hybrid work schedule if certain program guidelines are met; working arrangements may change at any time at the sole discretion of the agency.

Travel: 

Occasional

Agency Address: 

300 W. 15th St, Austin, TX 78701

Web site:

www.dir.texas.gov

Refer Inquiries to:   

People and Culture Office          

Telephone:

(512) 463-5920 or (512) 475-4612

HOW TO APPLY:

  • You must create a CAPPS Career Section candidate profile or be logged in to apply.
  • Update your profile and apply for the job by navigating through the pages and steps.
  • Once ready, select “Submit” on the “Review and Submit” page.
  • If you have problems accessing the CAPPS Career Section, please email the CAPPS Recruiting Help Desk at [email protected]

SPECIAL INSTRUCTIONS: 

  • Applicants must provide in-depth information in the EXPERIENCE & CREDENTIALS section to demonstrate how they meet the position qualifications. Incomplete applications may result in disqualification.
  • Resumes may be uploaded as an attachment but are not accepted in lieu of the information required in the EXPERIENCE & CREDENTIALS section of the application.

Interview Place/Time:

Candidates will be notified of appointments as determined by the selection committee.

Notice:

Section 651.005 of the Government Code requires males, ages 18 through 25 years, to provide proof of their Selective Service registration or proof of their exemption from the requirement as a condition of state employment.

EQUAL OPPORTUNITY EMPLOYER

The Department of Information Resources does not exclude anyone from consideration for recruitment, selection, appointment, training, promotion, retention, or any other personnel action, or deny any benefits or participation in programs or activities, which it sponsors on the grounds of race, color, national origin, sex, religion, age, or disability.  Please call 512-463-5920 to request a reasonable accommodation.

THE OPPORTUNITY

The Texas Department of Information Resources is the state agency charged with protecting the state’s data and critical technology infrastructure, managing a multi-million-dollar cooperative contracts program, and providing strategic technology leadership, solutions, and innovation to all levels of Texas government.  DIR is a fast-paced and collaborative environment with highly motivated and engaged employees dedicated to achieving the best value for the state.

A role within the Office of the State Chief Information Security Officer (OCISO) that combines progressive incident response program development, works with many diverse organizations, plans for, and responds to cyber events, and reviews and communicates threats and vulnerabilities to a wide range of stakeholders. You will play a critical role in responding to cybersecurity incidents in Texas and preparing our state for future cyber incidents. If you are looking to be a changemaker, this role is for you!

Performs highly advanced (senior-level) information security analysis functions.  Work involves protecting cybersecurity assets and delivering cybersecurity incident detection, incident response, threat assessment, cyber intelligence, software security, and vulnerability assessment services. Will be a visible figure in the state’s efforts to develop, expand, and deliver cybersecurity incident response services, standards, analysis, and guidance. This role works with data to identify patterns, uses judgment to form conclusions that may challenge conventional wisdom, and hypothesizes new threats and indicators of compromise that may impact the state of Texas.  This role will monitor threat intelligence feeds to identify a range of threats, including indicators of compromise and advanced persistent threats (APTs), and identify the tactics, techniques, and procedures (TTPs) of potential threats through the MITRE ATT&CK or similar frameworks to protect DIR and its customers. Will interact frequently with state agencies, institutions of higher education, local governmental officials, and other interagency personnel using a variety of communication mechanisms to engage and deliver incident response services, information, and threat research and analysis reports.  Work with the rest of the OCISO team to collaboratively identify and deliver statewide security program improvements and continuously improve the security posture of the state of Texas as a whole. Works under minimal supervision, with extensive latitude for the use of initiative and independent judgment. May, at times, assign and/or supervise the work of others.

WHAT WE DO

The ideal candidate will have the ability to highlight their strengths in the following functions:

  • Provides threat intelligence and CIRT program management to support the overall security posture of the state of Texas, including its agencies, institutions of higher education, cities, counties, special districts, and other qualified governmental entities. Develops, maintains, or supports a threat intelligence capability to identify current and emerging security risks to the state of Texas. Ensures the delivery of threat intelligence collected from incident engagements to threat intelligence teams and content creators for the purpose of operationalizing.
  • Plays a key role in the OCISO by supporting cyber incident response activities and services for any eligible governmental entity across the state of Texas and providing recommendations to prevent cybersecurity incidents.  Supports the planning, exercise, and preparedness of various local and state government partners to mature the state’s incident response capability.
  • In consultation with the DIR leadership, OCISO team, and other relevant stakeholders, develops and delivers tabletop preparedness exercises at the executive committee level, and at the technical or analyst level at least annually. Conducts threat assessments to identify what threats are most likely to target DIR and its customers and how they would execute their attacks.
  • Leads quarterly reviews of the incident response plan to ensure accuracy in accordance with DIR guidance and procedures for CIRT response activities. Ensures execution of the incident response process to the resolution of the incident. Assists in e-discovery and digital forensics chain of custody procedures when necessary. Ensures generation, maintenance, and protection of required incident records, such as investigator journals. Maintains situational awareness for cyber threats across the organization and drives the appropriate or commensurate response activities, where necessary. Uses open source and commercial intelligence providers to gain insight into adversary tactics, techniques, and procedures, as well as planned activities and emerging motivations.
  • Coordinates with industry partners, government agencies (including law enforcement and intelligence agencies,) and other specialists to establish and maintain situational awareness of current and emerging risks and threats to the state. Coordinates with the DIR Network Security Operations Center (NSOC), any Regional Security Operations Centers (RSOC), and at times Federally provided Security Operations Center ex: MS-ISAC SOC, provided internally or by an externally managed security services provider, to identify and assess security incidents.
  • Advises and presents significant emerging threats and provides both strategic and tactical steps to counteract these threats to the Department leadership and state cybersecurity community. Confers with agencies to discuss issues relating to information security. Researches, identifies, evaluates, and recommends systems and procedures in the field of Cybersecurity.
  • Assists with the investigation of active cyber incidents by monitoring threat actors on forums, the dark web, or other threat intelligence gathering spaces. Assists with threat monitoring of affected entities during active incidents and provides extended post-incident monitoring. If the CIRT Analyst is notified outside of normal working hours of a potential incident, then the CIRT Analyst will be expected to perform the role out of hours to the extent required to respond to the Cyber Incident.
  • Performs related work as assigned.

EDUCATION

  • Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field
  • Additional years of work-related experience may be used to substitute for each year of formal education. (High School diploma or equivalent certificate required.)

EXPERIENCE AND TRAINING REQUIRED

  • Five (5) years of progressively responsible experience in the IT industry
  • Five (5) years of progressively responsible experience in information technology security
  • Two (2) years of program or project management development and implementation

EXPERIENCE AND TRAINING PREFERRED

  • Project management experience in an information technology environment. 
  • Experience and training in analyzing, recommending, developing, and implementing cogent enterprise-wide policies, standards, and guidelines. 
  • Experience working with state or federal IT regulatory issues and processes.
  • Experience in researching and documenting findings on information technology issues, processes, or programs. 
  • Have or working towards obtaining the following certifications:
    • CompTIA Network+
    • CompTIA Security+
    • CompTIA Cybersecurity (CySA+)
    • CompTIA PenTest+
    • Certified Information Systems Security Professional (CISSP)
    • Global Information Assurance Certification (GIAC)
    • Offensive Security Certified Professional (OSCP)
    • Certified Ethical Hacker (CEH)
    • Network+ (Plus) Certification | CompTIA IT Certifications
    • Or similar certification or serve as a SME on a certification creation committee or equivalent.

KNOWLEDGE, SKILLS & ABILITIES

  • Knowledge of applied “sound security” concepts, such as the principle of least privilege, the use of multi-factor authentication, and identity and access management.
  • Broad understanding of the cybersecurity landscape including identity management, access management, access governance, and privileged access management capabilities and methodologies. 
  • Knowledge of generally accepted information technology standards and practices; of information technology practices; and of information technology management practices. 
  • Knowledge of the security limitations and capabilities of computer systems and of information security practices, procedures, and regulations.
  • Knowledge of security architecture and security program requirements.
  • Knowledge of relevant DIR IT Security Services and regulations including Texas Government Code Chapter 2059, Texas Administrative Code § 202, and other related security codes, documentation, standards, and best practices.
  • Knowledge of ITIL processes and standards.
  • Knowledge of standard concepts, practices, and procedures for computer operations and data center operations. 
  • Knowledge of benchmarking activities and expectations. 
  • Demonstrated ability to analyze large data sets and identify anomalies. 
  • Demonstrated ability to quickly create and deploy countermeasures under pressure.
  • Demonstrated ability to create complex scripts, develop tools, or automate processes in Python or other relevant command languages. 
  • Ability to communicate effectively using interpersonal skills and appropriate supporting technology.
  • Ability to promote and support the overall mission, goals, and efforts Office of the CISO and Statewide Security Program.
  • Ability to learn and adapt quickly in a dynamic environment. 
  • Ability to manage projects to resolve complex issues in diverse and decentralized environments. 
  • Ability to assist executives, through discussion and facilitation, in the process of evaluating and implementing security architecture and policies. 
  • Ability to establish and maintain effective and cordial working relationships at all organizational levels, including agency management, direct supervisors, co-workers, and internal and external customers. 
  • Ability to work independently and as part of a team, and to support and contribute to a cohesive team environment. 
  • Ability to understand, follow, and convey complex oral and/or written instructions. 
  • Ability to communicate both verbally and in writing in a clear and concise manner. 
  • Ability to work under pressure and exacting schedules to complete assigned tasks. 
  • Ability to work occasional overtime and/or a flexible schedule as needed to meet required deadlines.
  • Ability to travel as necessary. 
  • Ability to comply with all agency policies and applicable laws. 
  • Ability to comply with all applicable health and safety rules, regulations, and standards.

COMPUTER SKILLS

  • Proficiency in the use of a personal computer and applicable software necessary to perform work assignments e.g., word processing, spreadsheets (Microsoft Office preferred), and project management tools (Microsoft Project preferred). 

OTHER REQUIREMENTS

  • Regular and punctual attendance at the workplace.
  • Criminal background check.

WORKING CONDITIONS

  • Exposure to the standard office environment and office conditions
  • Frequent use of personal computers, copiers, printers, and telephone
  • Frequent sitting, listening, and talking
  • Frequent work under stress, as a team member, and in direct contact with others
  • Occasional bending and stooping
  • Infrequent lifting and climbing
  • May occasionally work extended hours
  • May occasionally travel

About File Formats

Some documents on this page are in the PDF format. Please download the Adobe Reader in order to view these documents.