Principal Information Security Analyst; Information Systems Analyst, Principal - Generalist

Job Appointment
:
Full Time, Regular
Work Schedule
:
Monday - Friday, 8:00 AM - 5:00 PM. Alternate schedules may be available.
Work Location
:
This position has an exception to work primarily remotely. However, there will be instances when it is necessary to come onsite for work (with as much advance notice as possible). Remote work must be performed within Oregon or Washington. For more information, .
Union Representation
: PROTEC
17. To view current labor agreements, .
Starting Pay
:
The City of Portland follows the Oregon Equal Pay Act. Your salary is determined based on the experience listed in your resume that is directly related and equivalent to the position for which you are applying.

Help protect the technology and critical infrastructure that Portland communities depend on every day.

The Bureau of Technology Services (BTS) is seeking two Principal Information Security Analysts to strengthen cybersecurity, reduce risk, and support reliable delivery of essential City services.

In this role, you will provide senior technical leadership across information technology (IT) and operational technology (OT) environments, including industrial control systems and supervisory control and data acquisition (ICS-SCADA) systems. You will translate complex security and compliance requirements into practical solutions that protect City information, support operational continuity, and improve cybersecurity maturity.

The two positions support the following service areas:

• Public Safety Service Area: Bureau of Emergency Communications, Portland Bureau of Emergency Management, Portland Fire & Rescue, and Portland Police Bureau.

• Public Works Service Area: Bureau of Environmental Services, Portland Parks & Recreation, Portland Bureau of Transportation, and Portland Water Bureau.

Both positions report to the Chief Information Security Officer (CISO) and work within a matrix reporting structure with their respective service area’s senior managers. Assignments may emphasize enterprise security architecture and engineering or OT cybersecurity and critical infrastructure resilience, depending on program priorities and candidate strengths.

These positions work primarily remotely, with onsite attendance required for operational needs and cybersecurity incidents. Remote work must be performed within Oregon or Washington.

• Lead cybersecurity improvements: Assess current capabilities, identify security gaps, and develop measurable improvement plans across City IT and OT environments.

• Advise on security architecture: Guide technology teams and leadership on secure system design, cloud security, identity and access management, data protection, network security, and zero trust principles.

• Strengthen security operations: Develop and improve technical baselines, secure configurations, monitoring, alerting, vulnerability management, and operating procedures.

• Protect critical infrastructure: Partner with operational teams to address OT and ICSS-CADA risks, including network segmentation, secure remote access, vendor connectivity, monitoring, and recovery readiness.

• Assess and prioritize risk: Conduct or support threat modeling, risk assessments, control reviews, vulnerability assessments, penetration testing, and audits. Recommend practical remediation and investment priorities.

• Support governance and compliance: Align cybersecurity practices with City policies, applicable regulatory requirements, and recognized frameworks. Prepare documentation and evidence that support audits and compliance reviews.

• Integrate security into City projects: Participate in architecture reviews and help incorporate cybersecurity requirements into technology planning, procurement, implementation, and service operations.

• Support incident response: Assist with investigation, containment, recovery, and improvements following cybersecurity incidents.

• Build shared understanding: Explain technical findings and risks to diverse audiences, document recommendations and decisions, and support training and knowledge sharing across teams.

• Experienced Technical Leader: Brings broad enterprise cybersecurity expertise and depth in security architecture, engineering, risk management, or OT security.

• Practical Problem Solver: Recommends security controls that balance risk, compliance, safety, operational continuity, and service delivery.

• Collaborative Partner: Builds trust across technical teams, bureau leadership, operational staff, vendors, and external partners. Can…