IT Security Analyst

Starting hiring salary - $ to $ annually

The IT Security Analyst is responsible for the overall cybersecurity program for the City of Brighton. This position analyzes business processes, identifies risks, facilitates the adoption of risk tolerance levels, conducts internal audits, identifies security shortfalls, makes recommendations on remediation and prevention, and carries out mitigation tasks that are needed. This position also serves as the primary subject matter expert in cybersecurity and parameter security.

This position performs training for all end users, installs, configures, and monitors security systems and alerts, and participates in analyzing and evaluating enterprise information security systems.

• Establishes, supports, and continuously improves enterprise security by researching, recommending, partnering, and adopting cybersecurity best practices.
• Act as the primary point of contact for all MDR (managed detection and response), EDR (endpoint detection and response), and VM (vulnerability management) processes.
• Assists with any external auditing functions, including NIST, CISA, MS-ISAC, CJIS, and other system industry audits.
• Conducts regular vulnerability scanning and recommends remediation steps.
• Coordinates regular penetration testing with external vendors & partners.
• Acts as a SME and provides cybersecurity training to all end-users.
• Installs, configures, and monitors security systems and responds to security system alerts, which include monitoring intrusion detection and prevention systems, firewalls, data encryption and other cyber security systems, technologies, and platforms.
• Oversee the City’s physical security initiatives and projects, including card access, personnel access permissions, security camera projects, and camera footage maintenance.
• Oversees the current state of the City's cybersecurity preparedness, developing plans to acquire or remediate systems and/or software where appropriate.
• Designs, coordinates implementation of, and monitors security measures for the protection of computer systems, networks, and information.
• Lead for security investigations and the Security Incident Management protocol.
• Reviews annually and coordinates any changes to the Incident Response Plan and the overall IT Security Policies/Standards.
• Works collaboratively with the IT Network and Systems Administrators to address security requirements for all city systems, whether on-premises or cloud-hosted.
• Works collaboratively with the IT Service Desk to identify, contain, and remediate end-user-related security incidents (viruses, credential compromises, etc.).
• Researches and evaluates current new vendors technologies and cybersecurity management tools.
• Strives to improve visibility of all systems and data.
• Assists in the preparation of bid specifications and requests for proposals.
• Act as the project manager and/or technical lead for implementing new security systems monitoring and policy enforcement platforms, including integrating systems, networks, events, and user access logs into vulnerability, compliance, inspection, and data scanning systems.
• Assesses all information systems endpoint security for potential risks and vulnerabilities and plans remediation and patching for all endpoints.
• Coordinates and conducts table-top exercises and other drills to test incident response.
• Document all work products and progress in the IT Service Management System.
• Ensure service level commitments are met to internal and external customers.
• Manage external security operation center (SOC) vendor relationship and performance.
• Participate in regional and national cybersecurity training and peer meetings.
• Performs other duties as assigned.

Bachelor’s degree in Cybersecurity, Computer Information Systems, Technology Management, or a related field and at least three (3) years of administration or management of information security systems to include the following: information security architecture, information security procedures and controls, physical security, attack & penetration testing, application testing, information assurance gap analysis, and incident response. Experience and training in Microsoft Windows servers, enterprise networking, application firewalls, and vulnerability scanning are required.

Certifications in cybersecurity, such as CISSP strongly preferred. Experience and training in ITIL with ITIL Foundations Certification preferred. CJIS certified or ability to obtain certification within 30 days of employment. Any equivalent combination of education, training, and experience which provides the required knowledge, skills, and abilities may be considered.

• Knowledge of security technologies, including firewalls, proxies, SIEM, antivirus software, endpoint asset management, and IdPs.
• Knowledge of network and cabling theory and applications.
• Knowledge of network protocols, architecture, and system design.
• Strong Knowledge of…