ANNOUNCEMENT NO. 196-2026 BENEFITS OPENING DATE: November 04, 2026 Retirement: LASERS CLOSING DATE: November 11, 2026 Insurance: Medical, Dental, & Vision Paid Holidays: 10 plus proclaimed *SALARY: Annual Leave: 96 hours per year with tenure increases MT-318 $75,046 - $135,096 Sick Leave: 96 hours per year with tenure increase MT-319 $80,309 - $144,560 MT-320 $85,925 - $154,690*Salary indicates typical starting range. Level will be determined by qualifications. JOB TYPE: Unclassified* *Current Classified employees must give up their designation to accept this position. POSITION DESCRIPTION:Serves as a Cyber Threat Analytics Center (CTAC) Specialist, responsible for monitoring, detecting, analyzing, and responding to cybersecurity threats across organizational networks and systems. This role supports continuous security operations by identifying suspicious activity, investigating incidents, and coordinating response efforts to protect critical infrastructure and information systems. Continuously monitor security tools such as SIEM, EDR, IDS/IPS, and firewalls to identify suspicious or anomalous activity. This includes reviewing and triaging alerts, correlating events across multiple data sources, and determining whether activity represents a legitimate threat or a false positive. The analyst maintains real-time situational awareness of the environment and ensures that validated threats are escalated appropriately based on severity and potential impact. Conduct detailed investigations into suspicious activity and confirmed security incidents. This involves analyzing logs, endpoint data, and network traffic to determine the scope, root cause, and impact of an incident. Coordinate with internal and external customer teams to support containment, eradication, and recovery efforts, while following established incident response procedures and playbooks to ensure a consistent and effective response. Document all alerts, investigations, and response actions within ticketing systems, ensuring clear and complete case management. Generate incident reports and after-action summaries, contribute to operational metrics, and maintain documentation that supports audits, compliance requirements, and organizational awareness. Conduct threat hunting activities designed to identify previously undetected threats. This includes leveraging threat intelligence, forming hypotheses, and analyzing available data for indicators of compromise. Assist in tuning detection rules, improving SIEM use cases, and identifying gaps in visibility to strengthen overall detection capabilities. Participate in training sessions, exercises, and knowledge-sharing activities to stay current on emerging threats and techniques. Collaborate with internal teams and external partners. Provide feedback to enhance SOC processes, tools, and overall effectiveness. Performs all other tasks, special projects, analysis, studies, and plans as directed. POSITION QUALIFICATIONS: Minimum Qualifications: Bachelor’s degree in Cybersecurity, Information Technology, or related field (or equivalent experience). 1–3 years of experience in cybersecurity, IT operations, or network defense. Familiarity with security monitoring tools (e.g., SIEM platforms, endpoint protection). Basic understanding of networking concepts (TCP/IP, DNS, HTTP/S). Knowledge of common attack techniques and frameworks (e.g., MITRE ATT&CK). Strong analytical and problem-solving skills. Strong verbal and written communication skills. Ability to work with minimal guidance, instruction, or supervision. Preferred Qualifications: Experience working in a Security Operations Center (SOC) environment. Hands-on experience with modern security platforms, including Google SecOps and CrowdStrike Falcon SIEM. Demonstrated ability to develop, maintain, and optimize incident response playbooks. Experience implementing and managing automation through SOAR (Security Orchestration, Automation, and Response) platforms. Fam
