Cybersecurity Analyst

Overview

Career Opportunities with Presidio Trust

A great place to work.

Current job opportunities are posted here as they become available.

The Presidio Trust is seeking a Cybersecurity Analyst to join its Information Technology Department. The Presidio Trust is an innovative federal agency that stewards and shares the history, beauty, and wonder of the Presidio for everyone to enjoy forever. The ancestral homeland of the Ramaytush Ohlone, the Presidio was once a military post under three flags. Today, it is a surprising national park site spanning 1,500 acres at the Golden Gate.

Its rare natural habitats, inspiring views, and world-class trails are a local and global attraction. It is among the most biologically diverse parks in America and a popular destination with beaches, museums, restaurants, hotels, homes, and offices.

Reporting to the Principal Cybersecurity Architect, the Cybersecurity Analyst provides operational cybersecurity support to protect the Trust’s information systems, networks, and data. The position performs day-to-day security monitoring, incident response support, vulnerability management, and compliance-related activities in accordance with established policies, procedures, and federal cybersecurity frameworks. The analyst monitors security events, investigates and triages incidents, supports remediation efforts, and helps implement and validate security controls across on-premise and cloud environments.

The role applies standards such as NIST, CIS Controls, and FISMA/FedRAMP to support audit readiness and the protection of mission-critical systems and data.

This is a full-time position with benefits. The starting pay range for candidates based in the San Francisco Bay area is $98,795 to $112,751, dependent on the experience and qualifications of the candidate. Salary may vary for candidates working from other locations. Applications received by February 13, 2026 will receive first consideration.

• Monitor, analyze, and correlate security alerts, logs, dashboards and events using cybersecurity tools (e.g. IAM, SIEM, endpoint protection, email security, network and cloud logs) to identify potential threats, anomalies, and suspicious activity.
• Triage and investigate cybersecurity incidents; validate alerts through correlating logs and indicators of compromise (IOCs) analysis to assess impact, reduce false positives, and support incident containment and recovery.
• Collect, preserve, and analyze initial incident evidence; document findings, develop timelines, and escalate significant or complex incidents to the Principal Cybersecurity Architect. Investigate and support end-to-end incident response activities, including containment, eradication, recovery, and evidence collection.
• Execute, maintain and improve incident response playbooks and standard operating procedures (such as phishing, malware, account compromise, suspicious privileged access, data exposure), to ensure consistent and efficient response actions.
• Support vulnerability scanning, risk-based prioritization, and remediation tracking across endpoints, servers, network devices, and cloud environments; collaborate with IT teams to reduce exposure and track remediation progress.
• Contribute to endpoint protection and detection engineering efforts, including EDR policy tuning, alert rule optimization, and escalation of detection gaps or recurring trends.
• Support engineering efforts to deploy new security tools and technical controls.
• Support administration, tuning and operations of cybersecurity tools (including identity and access management (IAM), endpoint and mobile device protection (EDR, MDM), security incident and event management (SIEM), firewalls, vulnerability management, email security, data loss prevention (DLP), web filtering, and cybersecurity training tools), coordinating changes and validating outcomes.
• Participate in technical evaluations of systems, security assessments, audits, and penetration testing activities by gathering evidence, validating control effectiveness, and supporting remediation planning.
• Maintain accurate and timely cybersecurity documentation, including incident reports, root…