Senior Cybersecurity Analyst

Position Summary

Hello, we’re Metro! Metro is dedicated to shaping a better future for the greater Portland region. The work the people of Metro do every day benefits the lives of the people who live here, today, and tomorrow.

The Information Security Team is looking for a Senior Cybersecurity Analyst to lead technical security operations, detection engineering, and incident response for Metro, protecting the systems, data, and services that people across the greater Portland region rely on every day.

The Senior Cybersecurity Analyst is the primary technical lead for Metro's security operations, detection engineering, and technical control execution, leading hands‑on threat detection, incident response, and continuous improvement of Metro's security posture across endpoint, identity, cloud, and network environments.

This role serves as a senior technical control operator for compliance frameworks (NIST CSF, CIS Controls, PCI DSS) in partnership with the Information Security Compliance Analyst, who leads control definition and governance, and acts as the technical incident lead during security events, with formal incident declaration owned by the CISO. As Metro's Information Security program matures, this position offers a clear growth path toward a future Principal Cybersecurity Analyst role with broader ownership of security architecture, detection strategy, and technical risk leadership.

• Serve as the CISO's primary technical lead for security operations, leading alert review, validation, escalation, and coordinated response for security events across Metro's environment.
• Act as technical incident lead during security events, coordinating containment, eradication, recovery, and post‑incident follow‑up in partnership with the CISO, IT teams, and SOC/MSSP providers.
• Develop, tune, and optimize detection content across SIEM, EDR, identity, cloud, and network security tools, incorporating threat intelligence and MITRE ATT&CK techniques.
• Operate and improve vulnerability management processes, providing risk‑based prioritization and partnering with the Compliance Analyst on remediation tracking and risk acceptance documentation.
• Implement, configure, and monitor technical safeguards under NIST CSF, CIS Controls, and PCI DSS, generating evidence to support compliance validation and audit activities.
• Own technical security review and ongoing oversight of third‑party services, SaaS platforms, and vendor integrations, evaluating authentication, data flows, and integration risk.
• Monitor Metro's identity security posture, tune identity threat detection tooling, and investigate identity‑based threats such as credential theft and lateral movement.
• Maintain secure configuration baselines using CIS Benchmarks, administer Metro's EDR platform, and participate in security architecture and design reviews for cloud and infrastructure changes.
• Implement and operate data protection controls (DLP, data monitoring, and audit capabilities), investigating alerts and partnering with the Compliance Analyst to align technical enforcement with policy intent.
• Contribute technical content to security standards and training materials, and identify opportunities to improve detection quality, control effectiveness, and operational efficiency.

• Technically curious with a strong drive to learn, improve, and expand security capabilities across endpoint, identity, cloud, and network domains.
• Detail‑oriented with strong analytical skills and a disciplined approach to detection engineering, evidence collection, and documentation.
• Comfortable leading technical incident response under pressure, exercising sound judgment about when to elevate versus resolve.
• Strong working knowledge of security frameworks (NIST CSF, CIS Controls, PCI DSS) with the ability to translate requirements into practical technical controls.
• Collaborative mindset with the ability to partner effectively with the Compliance Analyst, IT Infrastructure, Applications teams, Metro departments and business partners, and third‑party SOC/MSSP providers.
• Able to work independently on assigned technical priorities while…