IT Security Analyst

Job Description

Starting hiring salary - $109,139.83 to $115,688.22 annually DEFINITION The IT Security Analyst is responsible for the overall cybersecurity program for the City of Brighton. This position analyzes business processes, identifies risks, facilitates the adoption of risk tolerance levels, conducts internal audits, identifies security shortfalls, makes recommendations on remediation and prevention, and carries out mitigation tasks that are needed. This position also serves as the primary subject matter expert in cybersecurity and parameter security. This position performs training for all end users, installs, configures, and monitors security systems and alerts, and participates in analyzing and evaluating enterprise information security systems.

ESSENTIAL DUTIES & RESPONSIBILITIES Establishes, supports, and continuously improves enterprise security by researching, recommending, partnering, and adopting cybersecurity best practices. Act as the primary point of contact for all MDR (managed detection and response), EDR (endpoint detection and response), and VM (vulnerability management) processes. Assists with any external auditing functions, including NIST, CISA, MS-ISAC, CJIS, and other system industry audits. Conducts regular vulnerability scanning and recommends remediation steps. Coordinates regular penetration testing with external vendors & partners. Acts as a SME and provides cybersecurity training to all end-users. Installs, configures, and monitors security systems and responds to security system alerts, which include monitoring intrusion detection and prevention systems, firewalls, data encryption and other cyber security systems, technologies, and platforms. Oversee the City's physical security initiatives and projects, including card access, personnel access permissions, security camera projects, and camera footage maintenance. Oversees the current state of the City's cybersecurity preparedness, developing plans to acquire or remediate systems and/or software where appropriate. Designs, coordinates implementation of, and monitors security measures for the protection of computer systems, networks, and information. Lead for security investigations and the Security Incident Management protocol. Reviews annually and coordinates any changes to the Incident Response Plan and the overall IT Security Policies/Standards. Works collaboratively with the IT Network and Systems Administrators to address security requirements for all city systems, whether on-premises or cloud-hosted. Works collaboratively with the IT Service Desk to identify, contain, and remediate end-user-related security incidents (viruses, credential compromises, etc.). Researches and evaluates current new vendors technologies and cybersecurity management tools. Strives to improve visibility of all systems and data. Assists in the preparation of bid specifications and requests for proposals. Act as the project manager and/or technical lead for implementing new security systems monitoring and policy enforcement platforms, including integrating systems, networks, events, and user access logs into vulnerability, compliance, inspection, and data scanning systems. Assesses all information systems endpoint security for potential risks and vulnerabilities and plans remediation and patching for all endpoints. Coordinates and conducts table-top exercises and other drills to test incident response. Document all work products and progress in the IT Service Management System. Ensure service level commitments are met to internal and external customers. Manage external security operation center (SOC) vendor relationship and performance. Participate in regional and national cybersecurity training and peer meetings. Performs other duties as assigned.

MINIMUM QUALIFICATIONS Bachelor's degree in Cybersecurity, Computer Information Systems, Technology Management, or a related field and at least three (3) years of administration or management of information security systems to include the following: information security architecture, information security procedures and controls, physical security, attack & penetration testing, application testing, information assurance gap analysis, and incident response. Experience and training in Microsoft Windows servers, enterprise networking, application firewalls, and vulnerability scanning are required. Certifications in cybersecurity, such as CISSP strongly preferred. Experience and training in ITIL with ITIL Foundations Certification preferred. CJIS certified or ability to obtain certification within 30 days of employment. Any equivalent combination of education, training, and experience which provides the required knowledge, skills, and abilities may be considered.

KNOWLEDGE, SKILLS, AND ABILITIES Knowledge of security technologies, including firewalls, proxies, SIEM, antivirus software, endpoint asset management, and IdPs. Knowledge of network and cabling theory and applications. Knowledge of network protocols, architecture, and system design. Strong Knowledge of vulnerability scanning, penetration testing, network security, and the techniques used to expose and correct security vulnerabilities. Knowledge of current Microsoft Server operating systems and server hardware. Knowledge of enterprise server virtualization – VMWare preferred. Knowledge of enterprise storage and backup technology – Veeam preferred. Knowledge of business continuity and disaster recovery (BCDR) planning and methodologies. Knowledge of Microsoft Active Directory. Knowledge of Office365 system and security administration. A strong understanding of vulnerability scanning tools and incident response tools. Knowledge of Cisco switch, routing, firewalls, wireless, and access/identity. Knowledge of endpoint and mobile device management. Knowledge of security awareness training and phishing campaign applications. Knowledge of Microsoft System Center, Endpoint Manager, and WSUS patching. Knowledge of Malwarebytes and Microsoft Defender for Endpoint. Strong skills in documentation and standard/policy development. Ability to think critically and innovatively about security solutions. Ability to collaborate with peers and staff to build relationships based on values of mutual respect and trust. Ability to achieve consensus and lead and participate in discussion to translate technical concepts to non-technical staff while fostering understanding.

SPECIAL REQUIREMENTS Must pass advanced screening such as reference checks, background checks, local police checks, sex offender lists, driving record checks, drug screens, and fingerprint checks. Possession of a valid Colorado driver's license with a safe driving record. Completion of FEMA IS 100 and IS 700 within six (6) months of hire.