Search Jobs

The City of Lincoln is hiring a Systems Security Analyst II/Sr. in the Information Technology Department.

The Systems Security Analyst performs a variety of professional level work, including the design, implementation, evaluation, and daily management of security systems and solutions; and performs duties related to threat detection and prevention, education, risk assessment, compliance, governance, business recovery, forensics, and incident response.

• Systems Security Analyst II: $6,887.72 - $9,230.21
• Senior Systems Security Analyst: $7,232.09 - $9,691.69

DISTINGUISHING CHARACTERISTICS

Systems Security Analyst II

The Systems Security Analyst II is the journey level in the Systems Security Analyst class series and is responsible for the full range of duties. This class is distinguished from the next higher classification of Senior Systems Security Analyst in that the latter is an advanced journey level and performs more complex assignments and may have lead responsibilities. Employees at this level receive only occasional instruction or assistance as new, unusual or unique situations arise and are fully aware of the operating procedures and policies within the work unit. Positions in this class are flexibly staffed and are normally filled by advancement from the Systems Security Analyst I.

Senior Systems Security Analyst

The Senior Systems Security Analyst is the advanced journey level in the Systems Security Analyst class series. Incumbents are the recognized experts in their field, including possessing extensive experience designing and architecting complex information technology and security solutions, as well as demonstrating successful technical project management by the advanced level of knowledge and experience required. Positions at this level are distinguished from other classes within the series by the provision of the highest level of technical expertise and knowledge in the performance of duties.

SUPERVISION RECEIVED/EXERCISED

Systems Security Analyst II

Receives supervision from the Chief Innovation and Technology Officer. Incumbents of this class do not routinely exercise supervision.

Senior Systems Security Analyst

Receives general direction from the Chief Innovation and Technology Officer. Exercises technical and functional supervision over professional and technical personnel for assigned projects.

ESSENTIAL FUNCTIONS

(include but are not limited to the following)

• Architect, implement, monitor, maintain, and troubleshoot various security systems that protect the City’s networks, IT/OT systems (including SCADA), applications and critical infrastructure.
• Design, organize, modify, install, secure and support security infrastructure; and provide technical support for network and security issues associated with enterprise applications.
• Analyze both raw and processed security alerts, logs and event data to identify potential security incidents, threats, mitigations, and vulnerabilities.
• Architect, implement, maintain, and troubleshoot the City’s business continuity plan and emergency response plan as it relates to redundant, secure infrastructure.
• Investigate, analyze, produce reports, and remediate security incidents that occur on City systems and applications, both on-premises as well as in the cloud.
• Confirm viable backups, test, maintain and monitor both on-premises and within the cloud.
• Review Cyber Security threat information and assists with mitigating vulnerabilities identified.
• Conduct a variety of Cyber Security policy compliance tasks such as discovering unauthorized devices, conducting site surveys for non-compliance, and ensuring network access requirements are met.
• Perform risk assessments and execute tests of network, backups and information systems to ensure technology processes are secure.
• Facilitate administrator and end-user cyber security training and security awareness programs; track and report on end-user training compliance.
• Facilitates penetration testing of all City systems and infrastructure.
• Ensure systems and procedures are compliant with relevant industry requirements and government regulations (e.g., PCI-DSS, CJIS, NIST, NERC CIP, ISO 27000, etc.).
• Engage in continuous information security training to maintain awareness of changes within the information security field.
• Performs other or related duties as assigned.

PHYSICAL, MENTAL AND ENVIRONMENTAL WORKING CONDITIONS

Position requires prolonged sitting, standing, walking, reaching, twisting, turning, kneeling, bending, squatting, stooping, and intermittently climbing stairs and/or ladders to rooftops and walking rooftops perimeter in the performance of daily activities. The position also requires grasping, repetitive hand movement and fine coordination in keeping records and preparing reports using a computer keyboard. Additionally, the position requires near and far vision in reading written reports and work-related documents and acute hearing is required when providing phone and personal service. The nature of the work may require the incumbent to lift equipment and materials weighing up to 25 pounds or more.

KNOWLEDGE/SKILLS/ABILITIES

(The following are a representative sample of the KSAs necessary to perform essential duties of the position. The level and scope of the knowledge and abilities listed below vary between the I and II levels.)

Knowledge of:

All knowledge from the Systems Security Analyst I level, and NIST 800-series cyber security standards, CIS Top-20 Critical Security Controls, Payment Card Industry Data Security Standards (PCI-DSS), and Criminal Justice Information Security (CJIS) requirements; principles and practices of securing cloud-hosted systems and applications; principles and practices of complex operating system design, analysis, and documentation; current hacker techniques, exploits, active defense detection and prevention measures, penetration testing tools, tactics, techniques, and procedures (TTPs); unified threat management (UTM) firewalls and associated components including, but not limited to, URL/Content filtering, file scanning and blocking, DNS sinkholing, and data leakage prevention; endpoint detection and response (EDR) platform deployment, monitoring and management; business continuity planning, documentation, and testing best practices; computer and network forensic tools, techniques and analysis including root cause and comprehensive cause and effect analysis of cyber-attacks and breaches; scripting languages (e.g. PowerShell, Python, BASH, etc.) at an expert level; single sign-on, Multi-factor authentication and SAML concepts and applications; eDiscovery processes and techniques for messaging and other social media platforms; network monitoring tools and techniques used to perform security troubleshooting, including packet capture and protocol analysis tools; network routing and switching protocols (i.e., BGP, EIGRP, OSPF, RIP, VLANs, STP, VTP, IOS, NX-OS, HSRP, CDP, and LLDP); principles and practices of project management; file storage technologies, file structures, and file systems; and methods of application integration.

Skill to:

Operate an office computer and a variety of word processing and software applications.

Ability to:

All abilities from the Systems Security Analyst I level, and independently manage security-related projects, investigations, operations, and incident response; independently perform professional work involving the evaluation, implementation, and daily management of information security systems; implement and maintain compliance with all required information security rules, regulations, mandates, standards, and best practices; design, document, and implement secure network, system, and application architectures; on an ongoing basis, identify and declare observed risks, threats and vulnerabilities and propose practical steps to minimize or mitigate them; participate in, or lead, cross functional teams and meetings; perform and/or work with professional service providers to conduct risk assessments and/or ethical hacking/penetration testing against city systems to determine and mitigate vulnerabilities and other security issues; perform governance tasks, including research, analysis and evaluation, and provide recommendations regarding proposed security, network, and user systems and applications; and conduct various security awareness programs such as citywide cyber security training campaigns, phishing testing, and periodic targeted training initiatives.

THE SELECTION PROCESS

The process may include an in-basket exercise, individual interviews, panel interviews and/or other related components.  Only those candidates who have the best combination of qualifications in relation to the requirements and duties of the position will continue in the selection process. The candidate selected for the position will be required to complete a background check including reference checks, fingerprint check, medical exam, drug-screening and/or other related components.

Human Resources will make reasonable efforts in the examination process to accommodate persons with disabilities. Please advise Human Resources of any special needs a minimum of five days in advance of the selection process exam by calling (916) 434-3229 or emailing hr@lincolnca.gov. The City of Lincoln is an Equal Opportunity Employer.

The information contained herein is subject to change and does not constitute either an expressed or implied contract.

Final Filing Date: Open Until Filled- Apply Immediately 

Interviews: TBD

Resumes are not accepted in lieu of completing a City application.

THE POSITION

The main role for this position of Cybersecurity Analyst I/II will focus on Cybersecurity. The candidate that fills the role will assist in defining enterprise cybersecurity policies, standards, guidelines, and procedures to ensure a robust and current cybersecurity program. They will also be responsible to monitor and analyze cybersecurity incident-related data and determine the appropriate response.

DEFINITION

Cybersecurity Analyst I: Under general supervision, provides professional level work, including the design, implementation, evaluation, and daily management of security systems and solutions; and performs duties related to threat detection and prevention, education, risk assessment, compliance, governance, business recovery, forensics, and incident response. This position requires a strong understanding of cybersecurity concepts, as well as the ability to work in a dynamic, public service-oriented environment. Other duties would include but not limited to assisting Network Administrators with items relating to the Network Administrator position.

Cybersecurity Analyst II: Under limited supervision, provides advanced level work, including the design, implementation, evaluation, and daily management of security systems and solutions; and performs duties related to threat detection and prevention, education, risk assessment, compliance, governance, business recovery, forensics, and incident response. This position requires a strong understanding of cybersecurity concepts, as well as the ability to work in a dynamic, public service-oriented environment. Other duties would include but not limited to aiding other Network Administrators with items relating to the Network Administrator position. Positions in this class require frequent use of a high degree of independent judgment and interpretative ability.

Positions in the Cybersecurity Analyst II classification are flexibly staffed and normally filled from advancement from the Cybersecurity Analyst I class, or when filled from the outside, require specific cybersecurity technology experience. Appointment to this class requires the employee to be performing substantially the full range of Cybersecurity Analyst II duties and to meet the qualifications for the class. The class requires the ability to work independently exercising judgment and initiative and a greater knowledge of the City’s security systems and solutions.

EXAMPLES OF DUTIES

Architects, implements, monitors, maintains, and troubleshoots various security systems that protect the City’s networks, IT/OT systems (including SCADA), applications and critical infrastructure; designs, organizes, modifies, installs, secures and supports security infrastructure; and provides technical support for network and security issues associated with enterprise applications; analyzes both raw and processed security alerts, logs and event data to identify potential security incidents, threats, mitigations, and vulnerabilities. Architects, implements, maintains, and troubleshoots the City’s business continuity plan and emergency response plan as it relates to redundant, secure infrastructure. Investigates, analyzes, produces reports, and remediates security incidents that occur on City systems and applications, both on-premises as well as in the cloud; confirms viable backups, test, maintains and monitors both on-premises and within the cloud; works closely with other government agencies, law enforcement, and external cybersecurity vendors to stay updated on emerging threats and response strategies.  Performs other duties as required.

MINIMUM QUALIFICATIONS

Knowledge of:  Network security, threat detection, and incident response; common cyberattack methods such as phishing, ransomware, and malware; security tools like firewalls, intrusion detection systems (IDS), and encryption technologies; government regulations, data protection laws, and compliance frameworks (e.g., PCI-DSS, CJIS, NIST, NERC CIP, ISO 27000, etc.) is essential, as is the ability disaster recovery planning and maintaining cybersecurity policies tailored to local government infrastructure is critical for ensuring the safety of sensitive public data and services.

Ability to:  quickly respond to and mitigate cyber threats; analyze vulnerabilities specific to public sector environments. collaborate with internal teams and educating non-technical staff about security best practices; manage multiple tasks and prioritize threats is essential, as well as a keen attention to detail when conducting audits or reviewing security logs; adapt to evolving cyber threats and continuously update knowledge of emerging technologies and attack methods; think critically under pressure, especially during security breaches or system outages. interact positively and cooperate with co-workers, respond politely to customers, work as a team member, function under demanding time pressure, respond in a positive manner to supervision, and attend work and perform duties on a regular and consistent basis.

Experience:

Cybersecurity Analyst I: A minimum of 2-3 years of experience in cybersecurity or information security roles, preferably within government or public sector organizations.

Cybersecurity Analyst II: A minimum of 5 years of experience in cybersecurity or information security roles, preferably within government or public sector organizations.

Education:

Cybersecurity Analyst I: High school graduation or equivalent. Graduation from college or university with emphasis in computer science, information technology, or related field, and current certification (CCNA, MCSE, CCSA, CCSE, CEH, Security+) is desirable.

Cybersecurity Analyst II: High school graduation or equivalent. Graduation from college or university with emphasis in computer science, information technology, or related field, and current certification (CCNA, MCSE, CCSA, CCSE, CEH, Security+) is desirable.

License: Possession of a valid Class C California Driver License.

Applicants for this position must submit to a complete background investigation conducted by Daly City Police Department sworn personnel.