Security Analyst II – Threat Hunter; ISS

Security Analyst II – Threat Hunter (ISS7)# Oregon Job Opportunities## Security Analyst II – Threat Hunter (ISS7)
Apply:
Salem | DAS | Cyber Security Services:
Full time:
Posted Yesterday:
REQ-208727
** Initial Posting Date:
** 10/23/2026
** Final date to receive applications:
** 11/08/2026
** Agency:
** Department of Administrative Services
** Salary Range:**$6,846 - $10,344
** Position Type:
** Employee
*
* Position Title:

** Security Analyst II – Threat Hunter (ISS7)
*
* Job Description:

**** Security Analyst II – Threat Hunter (ISS7)
**** Salem, OR  - Hybrid
** Enterprise Information Services (EIS) is a state government-wide information technology (IT) organization led by Oregon’s State Chief Information Officer (CIO). The Cyber Security Services (“CSS”) is an information security management section within EIS. CSS’s mission:
Leading Oregon Government to safeguard the State’s information resources. CSS is comprised of the following units:
Governance Risk and Compliance, Enterprise Security Architecture, Network Security, and Security Operations Center (SOC).
** What You’ll Do
** As the Security Analyst II - Threat Hunter you’ll continuously monitor Microsoft Sentinel and Defender XDR for security threats, perform initial triage to validate and assess alerts, perform network threat detection and analysis, and provide timely, actionable notification and escalation to support effective incident response and protect state agencies from cyber threats.

Review the full position details, duties and working conditions here.
** What We Are Looking For
*** Six (6) years of information systems experience in:
Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics ;
** OR
* ** An Associate's degree in Computer Science, Information Technology, or related field, OR completion of a two (2) year accredited vocational training program in information technology or related field; AND four (4) years of information systems experience in:  Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics;

** OR
* ** A Bachelor's degree in Information Technology, Computer Science, or related field AND two (2) years of information systems experience in:
Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics;
** OR
* ** Master's degree in Information Technology, Computer Science, or related field
*** may substitute
*** for all of the above.
** Desired skills and attributes:*
* ** If you bring these skills and experience, be sure to show us—this is how we evaluate candidates for next steps!
*** Ability to perform deep incident investigations using Microsoft Sentinel Investigation Graph, entity behavior analytics (UEBA), and similar SIEM, XDR, EDR, and security investigation platforms.
* Ability to pivot across multiple security tools and data sources (e.g., Defender, Sentinel, Purview, Entra , Tenable One, email security, firewall, proxy, and network monitoring platforms) to develop investigative context and determine attack scope.
* Advanced KQL (Kusto Query Language) capability, including the ability to build complex queries, joins, unions, time-series queries, anomaly detection patterns, custom hunting queries, and scheduled analytics rules.
* Strong proficiency in investigating and correlating security telemetry across identity, endpoint, network, cloud, and email environments, including (but not limited to) Entra
-in logs, Microsoft 365 audit logs,…