Security Analyst II

Security Analyst II

Under the general guidance of the IT Strategy and Governance Officer, this position is responsible for growing and operating the agency IT Security Program at the Wisconsin Department of Financial Institutions (DFI). The Security Analyst II is expected to be familiar with a wide variety of IT security concepts, practices, and technologies. The position serves as an expert resource and relies on extensive experience and judgment to plan and accomplish goals. This includes providing advanced analysis to manage the security design, implementation, monitoring, and incident response related to networks, servers, storage, applications, databases, and endpoints. The position will lead projects to implement new security controls and technologies and assist with the creation of policies, procedures, standards, and guidelines. This position may lead and direct the work of others. A wide degree of creativity and latitude is expected.

Representative duties

• Administer CrowdStrike, Tenable, and Zscaler.
• Perform IT security risk assessments. Develop, recommend, and implement remediation strategies.
• Research vendor offerings and conduct proofs of concept.
• Coordinate with other teams to implement new technologies and remediate issues.
• Monitor asset inventory, installed agents, and status of devices.
• Review vulnerability dashboards and the organizational impact of the changing threat landscape.
• Monitor data inventories and policy violations. Produce reports and metrics.
• Author policies, procedures, standards, and guidelines related to IT security and compliance.
• Monitor and process incident response queues.
• Manage endpoint firewall operation and adjust as necessary.
• Work independently as well as within a team environment.

Key skills

• IT Security experience — 5+ years in the RAW structured screening fields; client PDF and RAW narrative specify 4–7 years.
• CrowdStrike administration — expert knowledge; 5+ years in RAW structured screening fields. RAW repost instructions specifically request 4–7 years with CrowdStrike.
• Tenable administration — expert knowledge. RAW top-required-skills heading specifies 4–7 years; the client PDF and RAW structured field do not give a separate Tenable tenure minimum. This experience was often missed in the original posting.
• Strong attention to detail.
• Excellent written and verbal communication skills.
• Experience requirements differ by source. Preserve the 5+ year RAW screening criteria for submission screening and seek client/MSP confirmation for candidates with 4 to under 5 years; do not silently treat the source difference as resolved or assume that 7 years is an upper limit.

Nice to have skills

• CISSP or equivalent — 1 year.

Interview process

• Microsoft Teams interview with camera on.

Equipment provision and remote-work equipment requirements are not specified in either source.

Candidate evaluation — prioritized skill baseline

Requisition 166719 baseline v1 — 12 October 2026. Reviewed against the client PDF, RAW posting, and completed merged JD. Both means the client PDF and RAW. Selection categories below reflect hiring impact; source classifications remain identified separately. No candidate has been scored.

Rank - Skill - Classification - Wt. - Source - Selection Rationale

1 - CrowdStrike Administration - Critical / Primary - 3 - Both — required; RAW 5+ years - Expert product depth is a repeated repost screen.

2 - Tenable Administration - Critical / Primary - 3 - Both — required - Explicit expertise; prior submissions missed this skill.

3 - IT Security - Critical / Primary - 3 - Both — required - Broad security judgment across infrastructure and applications.

4 - Vulnerability Remediation - Critical / Primary - 3 - Both — duties - Interpret dashboards and threat impact; implement remediation.

5 - Incident Response - Critical / Primary - 3 - Both — duties/narrative - Operate response queues and support security incidents.

6 - Security Risk Assessment - Critical / Primary - 3 - Both — duties - Assess risks and recommend effective controls.

7 - Security Implementation - Critical / Primary - 3 - Both — narrative/duties - Design and implement controls; lead security projects.

8 - Zscaler Administration - Required / Supporting - 3 - Both — duties - Operate the third named security platform.

9 - Endpoint Firewalls - Required / Supporting - 3 - Both — duties - Manage and tune endpoint firewall operation.

10 - Asset Monitoring - Required / Supporting - 3 - Both — duties - Track inventory, agent coverage, and device status.

11 - Security Compliance - Required / Supporting - 3 - Both — duties/narrative - Monitor data and violations; author policies and standards.

12 - Security Reporting - Required / Supporting - 3 - Both — duties - Produce actionable reports and metrics.

13 - Communication - Required / Supporting - 3 - Both — required - Communicate findings clearly in writing and verbally.

14 - Attention to Detail - Required / Supporting - 3 - Both — required - Accurate administration and security review.

15 - Teamwork and Autonomy - Required / Supporting - 3 - Both — duties - Work independently and coordinate across teams.

16 - Technology Evaluation - Required / Supporting - 3 - Both — duties - Research vendors and validate proofs of concept.

17 - CISSP or Equivalent - Preferred / Differentiating - 1 - Both — preferred; 1 year - Credential differentiator; not a mandatory gate.

Mandatory eligibility gates

Requirement - Status - Source - Clarification Needed

Current WI residency; no relocation - Explicit Hard Gate - RAW - Verify current residence; Madison proximity is preferred.

Onsite Madison availability - Explicit Hard Gate - RAW - Confirm initial onsite attendance. Trial length and remote eligibility are unspecified.

Not submitted to prior posting 165213 - Explicit Hard Gate - RAW - Check prior submission history.

Complete submission package - Explicit Hard Gate - RAW - Obtain WI Cover Sheet, R2R, legal-name resume, cover letter, and location confirmation.

Vendor submission limits - Explicit Hard Gate - RAW - Maximum two candidates; no replacement of withdrawals.

Subvendor depth and form - Explicit Hard Gate - RAW - If applicable, one level maximum and request form required.

Security requirements - Potential Hard Gate - RAW - Security Required is Yes; confirm exact screening/access conditions.

Experience minimums - Verification Required - Both / RAW fields - 4–7 years versus 5+ IT Security/CrowdStrike; Tenable tenure is unclear. Confirm before an exception.

Schedule and start availability - Verification Required - RAW - Confirm 40-hour day shift and projected 11/09/2026 start.

No degree, clearance level, or mandatory certification is specified. CISSP remains preferred. Technical requirements stay in the weighted baseline; the tenure conflict is tracked separately for verification.

Skill Equivalency Guidance

• CrowdStrike Administration: Direct Match is demonstrated hands-on CrowdStrike administration. Potential Functional Equivalent: another enterprise EDR platform may show transferable operations. Not Equivalent: general endpoint support or product name familiarity. Alternate EDR experience does not satisfy the named requirement without client approval.

• Tenable Administration: Direct Match is hands-on Tenable administration. Potential Functional Equivalent: Qualys or Rapid7 administration may demonstrate vulnerability-platform skills. Not Equivalent: viewing scan reports without administration. Substitution requires client clarification.

• IT Security: Direct Match is demonstrated security design, implementation, monitoring, and judgment across the relevant technology estate. Potential Functional Equivalent: comparable enterprise security operations. Not Equivalent: general IT tenure without security responsibilities.

• Vulnerability Remediation and Security Risk Assessment: Direct Match is demonstrated risk analysis, prioritization, and remediation ownership. Potential Functional Equivalent: similar enterprise assessment and remediation workflows. Not Equivalent: scanning alone or generic compliance familiarity.

• Incident Response: Direct Match is triage and processing of security incidents or queues. Potential Functional Equivalent: comparable SOC response workflows. Not Equivalent: ordinary help-desk ticket management alone.

• Security Implementation: Direct Match is security-control design and implementation with project ownership. Potential Functional Equivalent: comparable control delivery in another enterprise environment. Not Equivalent: project participation without security implementation evidence.

About Us: InterSources Inc

InterSources Inc, a Certified Diverse Supplier, was founded in 2007 and offers innovative solutions to help clients with Digital Transformation