Cyber Intelligence Center- Cyber Incident Manager

San Bernardino County's Innovation and Technology Department (ITD) is seeking qualified and motivated professionals to serve as the Cyber
Intelligence Center (CIC)- Cyber Incident Manager (CIM)*. The County’s CIC protects and monitors critical government services and systems in a highly regulated environment, residents’ data assets, and departmental operations.

In this role, you will oversee countywide cybersecurity events and incidents from initial triage through recovery, lead daily CIC briefings to establish priorities, and coordinate a unified threat-informed response.

The CIC CIM is a subject-matter expert responsible for:

• Managing and leading the County’s CIC staff in coordinating analysis, responses (e.g., Threat Modeling), containment/eradication, recovery, and post-incident activities of cybersecurity incidents.
• Knowledgeable in the selection and application of various threat models.
• Coordinating activities across the County with affected departments’ leadership and technical teams, legal and privacy personnel, external partners, etc.
• Overseeing the incident lifecycle, including detection, analysis, containment, evidence preservation, eradication, recovery, and post-incident improvements in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-61r3 and NIST Cybersecurity Framework 2.0.
• Monitoring incident response activities and service-level agreements with the County’s Managed Detection and Response (MDR) Services partner.
• Administer, support, and formulate relevant County / ITD policies, standard practices, and procedures.
• Lead, develop, and administer table-top exercises throughout the County / ITD as required.
• Provide presentations, briefings, etc. as required to County and departmental leadership.
• Ability to translate technical cyber information into layman’s terms for briefings, after-action reports, etc.
• Ability to identify, quantify, and maintain relevant incident response matrices, tracking Mean-Time-To-Respond (MTTR), etc.
• Manage the County’s Security Information and Event Management (SIEM) environment that includes but not limited to the architecture, connectors, analytics, watchlists, workbooks, etc.
• Develop SIEM automation rules and logic app playbooks to codify containment and enrichment, integrating identity, endpoint, email, and network actions while preserving forensic evidence.
• Promoting ITD security cultural norms, including outcome-based execution, fact-based problem-solving, a sense of urgency, and collaboration.
• Managing, leading, and developing Information Security Analysts and other CIC team members.

Official job title:
Information Security Analyst III; for detail refer to the Information Security Analyst III job description.

The Innovation and Technology Department is San Bernardino County’s primary technology service provider entrusted with managing and safeguarding the County’s enterprise mission critical systems and infrastructure. It is our goal to empower the County through innovation and enterprise solutions that promote progress through technology and provide transparency and mobility that enable staff to focus on addressing and resolving issues toward the progress of the County’s mission, ensuring continued success.

Learn more about our initiatives in IT's Strategic Plan.

To review job specific benefits, refer to:
Summary of Benefits and Memoranda of Understanding (MOU).

Pre-Employment Process: Selected candidates must successfully pass a background check and a job-related physical exam, including a drug test, prior to employment.

Availability: Incumbents may occasionally work evening and weekend hours. Some overtime, on-call, or call back work may be…