Senior Cybersecurity Analyst

Senior Cybersecurity Analyst

Metro is dedicated to shaping a better future for the greater Portland region. The work the people of Metro do every day benefits the lives of the people who live here, today, and tomorrow.

The Information Security Team is looking for a Senior Cybersecurity Analyst to lead technical security operations, detection engineering, and incident response for Metro, protecting the systems, data, and services that people across the greater Portland region rely on every day.

The Senior Cybersecurity Analyst is the primary technical lead for Metro's security operations, detection engineering, and technical control execution, leading hands-on threat detection, incident response, and continuous improvement of Metro's security posture across endpoint, identity, cloud, and network environments.

This role serves as a senior technical control operator for compliance frameworks (NIST CSF, CIS Controls, PCI DSS) in partnership with the Information Security Compliance Analyst, who leads control definition and governance, and acts as the technical incident lead during security events, with formal incident declaration owned by the CISO. As Metro's Information Security program matures, this position offers a clear growth path toward a future Principal Cybersecurity Analyst role with broader ownership of security architecture, detection strategy, and technical risk leadership.

As the Senior Cybersecurity Analyst you will:

• Serve as the CISO's primary technical lead for security operations, leading alert review, validation, escalation, and coordinated response for security events across Metro's environment.
• Act as technical incident lead during security events, coordinating containment, eradication, recovery, and post-incident follow-up in partnership with the CISO, IT teams, and SOC/MSSP providers.
• Develop, tune, and optimize detection content across SIEM, EDR, identity, cloud, and network security tools, incorporating threat intelligence and MITRE ATT&CK techniques.
• Operate and improve vulnerability management processes, providing risk-based prioritization and partnering with the Compliance Analyst on remediation tracking and risk acceptance documentation.
• Implement, configure, and monitor technical safeguards under NIST CSF, CIS Controls, and PCI DSS, generating evidence to support compliance validation and audit activities.
• Own technical security review and ongoing oversight of third-party services, SaaS platforms, and vendor integrations, evaluating authentication, data flows, and integration risk.
• Monitor Metro's identity security posture, tune identity threat detection tooling, and investigate identity-based threats such as credential theft and lateral movement.
• Maintain secure configuration baselines using CIS Benchmarks, administer Metro's EDR platform, and participate in security architecture and design reviews for cloud and infrastructure changes.
• Implement and operate data protection controls (DLP, data monitoring, and audit capabilities), investigating alerts and partnering with the Compliance Analyst to align technical enforcement with policy intent.
• Contribute technical content to security standards and training materials, and identify opportunities to improve detection quality, control effectiveness, and operational efficiency.

Attributes for success:

• Technically curious with a strong drive to learn, improve, and expand security capabilities across endpoint, identity, cloud, and network domains.
• Detail-oriented with strong analytical skills and a disciplined approach to detection engineering, evidence collection, and documentation.
• Comfortable leading technical incident response under pressure, exercising sound judgment about when to escalate versus resolve.
• Strong working knowledge of security frameworks (NIST CSF, CIS Controls, PCI DSS) with the ability to translate requirements into practical technical controls.
• Collaborative mindset with the ability to partner effectively with the Compliance Analyst, IT Infrastructure, Applications teams, Metro departments and business partners, and third-party SOC/MSSP providers.
• Able to work independently on assigned technical priorities while communicating clearly with both technical and non-technical stakeholders.
• Comfortable with ambiguity and program-building, given that tooling, processes, and governance structures are still actively maturing.
• Reliable and responsive as a technical escalation point for high-severity or time-sensitive security events.
• Growth-oriented, with the interest and capability to progress toward broader ownership of security architecture, detection strategy, and technical risk leadership.
• Genuine interest in continuous learning and staying current on evolving threats, tooling, and best practices in a public-sector context.

Diversity and inclusion:

At Metro, we strive to cultivate diversity, advance equity, and practice inclusion in all of its work. This means attracting and empowering a workforce that is inclusive of a broad range of human qualities. Workplace diversity is both a moral imperative and a business strength, essential to providing quality support and services to our region. Metro's goal is to hire, develop and retain highly skilled and talented individuals across all departments and programs who best reflect the diversity of our community.

To qualify:

• 4-6 years of related professional experience in cybersecurity, security operations, detection engineering, incident response, vulnerability management, identity and access management, network security, cloud security, or a related technical field.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education, certification, and related professional experience.
• Any combination of education, professional, volunteer and lived experience that provides the necessary knowledge, skills, and abilities to perform the classification duties and responsibilities.

If this statement is true for you, then you may be ineligible to apply:

If you were terminated for cause during any employment with Metro, or resigned in lieu of termination, you may be ineligible for rehire for a minimum of 3 years.

Hybrid Telework:

This position is designated as "hybrid telework." You will be required to work onsite and at times have the option to work away from your assigned work location. The specific schedule and balance of onsite and telework will be discussed with the hiring manager at the time of offer. This position also requires off-hours response to security events, incidents, or urgent operational needs, which may include remote response and onsite response when necessary. Employees must reside in Oregon or Washington to work at Metro. Please note, the designation of hybrid telework may be subject to change at a future time.

Preferred qualifications/transferable skills:

• Demonstrated experience with technical control implementation, endpoint protection, identity security, network security, cloud security, logging, monitoring, or compliance-related safeguards.
• Working knowledge of cybersecurity frameworks and control practices, including NIST CSF, CIS Controls, PCI DSS, or similar risk-based security frameworks.
• Strong written and verbal communication skills, including the ability to document findings, procedures, and technical recommendations for both technical and non-technical audiences.
• 6 or more years of progressively responsible cybersecurity or closely related technical experience, including senior-level ownership of security operations, detection engineering, incident response, or enterprise security controls.
• Demonstrated ability to grow into principal-level responsibility for security architecture, detection strategy, and technical risk leadership.
• Experience in public sector, local government, or critical infrastructure security environments.
• Hands-on experience with CrowdStrike Falcon modules (EDR, NG-SIEM, Identity Protection, or Exposure Management).
• Familiarity with Palo Alto Networks firewall administration or network security monitoring.
• Experience with Microsoft Entra ID, Active Directory, or cloud identity and access management in AWS or GCP environments.
• Familiarity with the MITRE ATT&CK framework and its application to detection and threat hunting.
• Preferred certification: CISSP. Other relevant certifications may include:
• Security+, CySA+, SSCP, GSEC
• GCIA, GCIH, or CEH

Screening and evaluation:

The application packet: The application packet consists of the following required documents. Please ensure that you upload these documents in your online application. Make sure your application is complete, missing any part of these items could result in an incomplete application and will not be moved forward in the recruitment.

• A completed online application
• Responses to supplemental questions

The selection process: We expect to evaluate candidates for this recruitment as follows. The selection process is subject to change.

• Initial review of minimum qualifications
• In-depth evaluation of application materials to identify the most qualified candidates
• Consideration of top candidates/interviews
• Testing/assessments
• Reference check
• Background records check

Compensation, benefits and representation:

The full-salary range for this position is step 1: $94,106.41 to step 7: $126,1