Cybersecurity Administrator- Information Technology

Cybersecurity Administrator
- Information Technology (Finance) Job Description

PURPOSE SUMMARY. Responsible for supporting the day-to-day administration, configuration, monitoring, and maintenance of the County's information security tools and controls with integrity, discipline, and accountability. The position focuses on consistently implementing approved security policies, procedures, baselines, and controls; monitoring security events; supporting vulnerability management; administering email security protections; assisting with security incident response; and providing accurate operational reports and documentation. The Cybersecurity Administrator applies a disciplined approach to security operations, follows established processes, maintains confidentiality and ethical standards, and collaborates with IT staff, county departments, vendors, and the Information Security Engineer to help protect County data, systems, and technology assets from cyber threats.

1. Strategic Planning

• Maintain operational runbooks, checklists, knowledge-base articles, configuration notes, and administrative documentation for assigned security tools and recurring security tasks.
• Provide technical information and supporting documentation for risk, compliance, and audit remediation activities.
• Provide technical input to support updates to security procedures, baselines, and standards when requested.
• Monitor industry security updates, changes, technologies, emerging threats and best practices for continuous improvement.
• Identify and track operational security metrics for assigned tools, controls, alerts, email security activity, vulnerabilities, and remediation efforts.
• Assist with assessment of computer systems and security risks by researching potential threats and vulnerabilities.
• Support preventive measures, control techniques, patch prioritization, and remediation tracking.
• Stay up-to-date on the latest email security threats and trends and adapt configurations accordingly.
• Assist with security education, training, and awareness activities using approved materials and guidance.

2. Acquisition & Deployment

• Configure and maintain approved email encryption solutions and email authentication controls to ensure the confidentiality of sensitive information (e.g. SPF, DKIM, DMARC, S/MIME, PGP).
• Implement and follow approved IT security and privacy policies, standards, guidelines, baselines, processes, and procedures.
• Implement and maintain approved security controls such as firewalls, intrusion detection/prevention systems (IDS/IPS), access controls, endpoint protection, web filtering, and related security technologies.
• Implement and enforce security technologies and methodologies including: VPN, Wireless Authentication, and Enterprise anti-virus software.
• Assist IT managers and staff with technical implementation of approved security and compliance requirements within projects, initiatives, and operations.
• Promote a culture of security by encouraging employees to report suspicious emails and potential security concerns.

3. Operational Management

• Administer, configure, monitor, and maintain assigned security software, hardware, and cloud security tools to ensure reliable operation and appropriate protection.
• Monitor security logs, network traffic, endpoint alerts, authentication logs, and email systems for anomalies, suspicious activity, and potential security incidents.
• Administer and maintain email security gateways and filtering solutions to block spam, phishing attempts, malware, and other malicious content.
• Run periodic vulnerability scans and security checks using approved tools and procedures.
• Validate findings, document remediation status, and work with IT teams to address identified weaknesses.
• Perform initial triage, collect logs and technical evidence, document actions taken, and elevate incidents according to approved incident response procedures.
• Assist with containment, remediation, and recovery activities for security incidents within assigned systems and tools.
• Provide technical support and information for coordination with law enforcement, outside agencies, external auditors, vendors, or managed security service providers as directed.
• Investigate reported phishing messages and suspicious email activity; document findings and elevate significant trends, incidents, or risks.
• Assist with internal investigations by reviewing security logs, email (traces, quarantine records, archives), and related…