Information Technology Security Analyst

Information Technology Security Analyst $84,538.06 - $107,893.97 annually Final Filing – 5:00 pm Thursday, July 16, 2026 Qualifications The Court is conducting an open recruitment for the classification of Information Technology Security Analyst. Under the direction of the Chief Information Security Officer, the Information Security Analyst supports the protection of court information systems, case-management platforms, and sensitive judicial data. The analyst monitors systems for threats, assists with incident response, and helps maintain compliance with statewide judicial security standards. Only applicants who meet the minimum qualifications by the final filing day may apply. Regular and punctual attendance is essential. Responsibilities Network Monitoring – Monitor court networks, servers, and applications for suspicious activity or security breaches. Incident Response – Investigate alerts, document incidents, and escalarte issues to senior analysts when needed. Security Tools Management – Assist with operating firewalls, endpoint protection, encryption tools, MDM, and SIEM platforms. Vulnerability Management – Coordinate monthly vulnerability assessments, maintain the vulnerability dashboard, and collaborate closely with the IT team to prioritize and track patching remediation. Policy & Compliance Support – Help maintain security policies aligned with Judicial Council standards and statewide IT governance such as CJIS, CLETS, and NIST 800-53 best practices. Security Awareness & Compliance – Administer simulated phishing campaigns, analyze results, and conduct user follow‑ups. Track compliance for mandatory cybersecurity and AI training, and ensure staff sign‑off on the Information Systems Security Policy (ISSP). Email Security Operations – Triage suspicious email reports, verify legitimacy, and perform block or remediation actions directly within the Microsoft 365 tenant. Documentation & Reporting – Prepare reports on findings, risks, and recommended improvements. Physical Security – Security camera and physical access management. Assist with camera password change and network segmentation. Security footage requests. Audit Responsibilities – Conduct regular reviews of privileged access (PIM), monitor Microsoft 365 and on-premises environments for unusual admin connection attempts, conduct general access review (M365/On‑prem), verify and monitor MFA activation states, and review installed software periodically. Ideal Candidate - Core Knowledge & Skills Foundational Cybersecurity Knowledge Information Security Principles – CIA triad, threat types, risk, controls. Common Attack Vectors – phishing, malware, ransomware, credential attacks. Security Best Practices – principle of least privilege, patching, secure configuration. Systems & Network Knowledge Windows Security – Active Directory basics, permissions, event logs. Linux Security – file permissions, system logs, SSH hardening. Networking Fundamentals – TCP/IP, ports, protocols, firewalls, VPNs, and network segmentation (e.g., isolating IoT/security camera networks). Cloud Security Basics – identity and access in Azure/Entra ID, shared responsibility model, cloud workload migration basics, and MDM concepts. One or more scripting languages (e.g., PowerShell, Python, bash). Security Operations (SOC) Skills SIEM Monitoring – log analysis, alert triage, correlation rules. Incident Response – detection, containment, documentation, escalation. Endpoint Protection – EDR tools, malware detection, remediation steps. Vulnerability Scanning – interpreting scan results, prioritizing fixes. Email Security & Phishing Triage – analyzing email headers, recognizing phishing indicators, and executing tenant‑level blocks or remediation. Identity & Access Management IAM Concepts – authentication, authorization, MFA, provisioning. Identity Auditing – privileged access reviews (PIM), Active Directory/Azure account monitoring, and MFA activation tracking. Role Based Access Control – applying least privilege in a court environment. Public Sector & Court Specific Knowledge Judicial Data Sensitivity – sealed records, confidential case files. Government IT Governance – compliance, audits, documentation. Change Management – structured updates, approvals, tracking. CJIS Compliance Framework – understanding of Criminal Justice Information Services (CJIS) standards, specifically regarding authorized access controls and software compliance. Tools & Technologies SIEM Platforms – Splunk, Sentinel, Huntress. Ticketing Systems – ServiceNow, Jira, Cherwell. Vulnerability Scanners – Nessus, Qualys, Forta, OpenVAS. Endpoint Security Tools – CrowdStrike, Defender for Endpoint, and Microsoft Intune (MDM). Soft Skills & Professional Competencies Analytical Thinking – interpreting logs, identifying patterns. Technical Writing – documenting incidents clearly for executive review. Communication Skills – explaining security issues to non‑technical staff. Ethical Judgment – handling confidential judicial information responsibly. Education and Work Experience Bachelor's Degree in computer science, information systems or a closely related field and at least 2 years’ experience in cybersecurity, systems administration, operating systems, network analysis and/or management or a similar field in a multi‑platform information systems environment. Associate's Degree in computer science, information systems or a closely related field and at least 4 years’ experience in the same areas. Associate's Degree and CompTIA Security+, Cybersecurity Analyst+, CISA, or equivalent certification and at least 2 years’ experience in the same areas. Any combination of experience and education that would provide the required knowledge and abilities is qualifying. Working Conditions Primary work location: Martinez, CA, with occasional travel to other Contra Costa County courthouses (Richmond, Pittsburg, Walnut Creek). Fast‑paced environment supporting judges, clerks, and justice partners. Handling of confidential, sealed, and sensitive case information. Occasional after‑hours or on‑call support during security incidents. Conditions of Employment Successful completion of fingerprint and a criminal record background check is required prior to appointment and is a condition of employment. Requirement for a valid California driver’s license or the ability to travel independently between court locations. All employees who operate a vehicle on court business must certify possession of a valid California driver’s license and required levels of automobile insurance. Convictions Felony and misdemeanor convictions MAY BE disqualifying for employment with the court. The court will assess the nature and gravity of the offense, the time elapsed since the offense was committed, and the nature of the job duties to be performed. Employment Eligibility In accordance with the Immigration Reform and Control Act of 1986, all persons hired after November 6, 1986, are required to present original documents that show satisfactory proof of identity and U.S. citizenship or legal authorization to work in the United States. Union Representative This position is an exempt, unrepresented position. Applicants with Disabilities The Court will make reasonable accommodations so applicants with disabilities may participate in the recruitment process. Please advise Human Resources at (925) 608‑2606 of special needs in advance. Equal Opportunity Employer The Court is an equal opportunity employer. The Court provides equal employment opportunity at all times and does not discriminate in violation of applicable law. #J-18808-Ljbffr