Security Operations Center (SOC) Analyst

All applicants will be considered, however SROA/Surplus candidates will be given priority.

Are you interested in making life better for Californians? Are you looking for a career and not just a job? Do you want to create a meaningful impact in your community? If you answered yes to any of these questions, then the California Department of Tax and Fee Administration (CDTFA) has a career opportunity waiting for you! California not only needs you, it wants you as part of the growing workforce. New employees, new ideas, and new creative perspectives are needed in all areas at the CDTFA. We value staff and are dedicated to employee career development. Our agency supports the development of staff by offering training to flourish in their position and programs to promote and explore upward mobility. To learn more about us, please see CDTFA Gateway to New Opportunities video


Under the direction of the Deputy Chief Information Security Officer/Privacy Officer, Information Technology Manager I (IT Manager I), the Information Technology Specialist I (IT Spec I) is a member of the Security Operations Center (SOC) and the California Department of Tax Fee & Administration's (CDTFA) Cyber Incident Response Team. The IT Spec I demonstrates expertise in Security Operations and is a high-level technical security specialist. The IT Spec I will perform security operations duties on identification of information assets, security detections, security analysis and response activities to advance critical enterprise protection and to provide cyber defense of CDTFA information assets, taxpayer and employee information.

The IT Spec I creates and operates processes and tooling to establish and maintain comprehensive asset and network monitoring and defense against security threats across the enterprise's network infrastructure and user base. The IT Spec I works with enterprise-wide staff to prepare, detect and respond to attacks in a timely manner. The IT Spec I develops and maintains a working level knowledge of relevant IT infrastructure and technologies under the protection of the SOC, of applicable State/Federal and industry regulations and industry accepted best practices according to information security, policies and procedures, threat management and vulnerability, products, practices and processes. The IT Spec I also maintains a working level knowledge of the threat landscape, risk management processes, operating systems, cloud security, identity and access management, network architecture and protocols.

How did you hear about this opportunity? Tell us in this brief survey.


Here is the link to the Information Technology Specialist I examination bulletin.

Here is the link to the Information Technology Specialist I (LEAP) examination bulletin.

Under Government Code 14200, this position may be eligible for partial telework for eligible candidates residing in California. All telework/hybrid schedules require staff to report to the office a minimum number of days per week. Schedules are subject to change.


Currently, per the California Budget Act of 2025, all California Department of Tax and Fee Administration salaries are subject to the provisions of the State of California's Personal Leave Program.


This recruitment has been posted for more vacancies than currently exist as it may be used to fill additional identical vacancies which occur within 180 days of the closing date of this bulletin.


You will find additional information about the job in the Duty Statement .

Working Conditions

• Position may be located in a high-rise building.
• Standard office environment.
• Daily use of a personal computer, office equipment, and/or telephone.
• Telework is partially available.

Minimum Requirements You will find the Minimum Requirements in the Class Specification.

• INFORMATION TECHNOLOGY SPECIALIST I

Additional Documents

• Job Application Package Checklist
• Duty Statement

Position Details Job Code #:
JC-531810


Position #(s):
291-381-1402-121

Working Title:
Security Operations Center (SOC) Analyst


Classification:
INFORMATION TECHNOLOGY SPECIALIST I $6,513.00 - $8,729.00 A
$7,163.00 - $9,599.00 B
$7,864.00 - $10,537.00 C
New to State candidates will be hired into the minimum salary of the classification or minimum of alternate range when applicable.


# of Positions:
Multiple


Work Location:
Sacramento County


Telework:
Hybrid


Job Type:
Permanent, Full Time


Department Information
"Discover what makes CDTFA an employer of choice by exploring a video of our vibrant campus!"

California not only needs you; it wants you as part of the growing workforce. The California Department of Tax and Fee Administration (CDTFA) makes life better for Californians by fairly and efficiently collecting the revenue that supports our essential public services, with CDTFA administered programs accounting for about twenty-three (23%) percent of all state revenue. Tax programs administered by the CDTFA are concentrated in two general areas - sales and use tax, and special taxes and fees. New employees, new ideas, and new creative perspectives are needed in all areas at CDTFA. CDTFA offers employees reliable income, stable benefits, work-life balance, paid holidays, advancement opportunities, and the personal fulfillment of knowing that your work is personally impacting the lives of others.


Department Website:


Special Requirements

• This employer participates in E-Verify and will provide the federal government with your Form I-9 information to confirm that you are authorized to work in the U.S.; for more information about E-Verify, please go to

• Position requires employee to be fingerprinted and successfully pass a background investigation.

Application Instructions
Dates printed on Mobile Bar Codes, such as the Quick Response (QR) Codes available at the USPS, are not considered Postmark dates for the purpose of determining timely filing of an application.
Final Filing Date: Until Filled
Who May Apply
Individuals who are currently in the classification, eligible for lateral transfer, eligible for reinstatement, have list or LEAP eligibility, are in the process of obtaining list eligibility, or have SROA and/or Surplus eligibility (please attach your letter, if available). SROA and Surplus candidates are given priority; therefore, individuals with other eligibility may be considered in the event no SROA or Surplus candidates apply. Individuals who are eligible for a Training and Development assignment may also be considered for this position(s). Applications will be screened and only the most qualified applicants will be selected to move forward in the selection process. Applicants must meet the Minimum Qualifications stated in the Classification Specification(s).


How To Apply
Complete Application Packages (including your Examination/Employment Application (STD 678) and applicable or required documents) must be submitted to apply for this Job Posting. Application Packages may be submitted electronically through your CalCareer Account at When submitting your application in hard copy, a completed copy of the Application Package listing must be included. If you choose to not apply electronically, a hard copy application package may be submitted through an alternative method listed below:


Address for Mailing Application Packages


You may submit your application and any applicable or required documents to:


CA Department of Tax and Fee Administration
Talent Acquisition Section
Attn: Certification Section - JC-531810
651 Bannon Street, Suite 100 MIC: 00


Sacramento , CA 95811


Address for Drop-Off Application Packages


You may drop off your application and any applicable or required documents at:


CA Department of Tax and Fee Administration
Human Resources Bureau (App Drop Off)
Northwest Tower 1st Floor Lobby Drop Box (JC-531810)
651 Bannon Street


Sacramento , CA 95811
Monday - Friday (Excluding Holidays)
08:00 AM - 04:00 PM


Required Application Package Documents


The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is required and must be included.
• Other - A completed Supplemental Questionnaire (SQ) must be submitted with your STD. 678 in order to be considered for this position. Please see the Supplemental Questionnaire Requirement section of this job posting for additional information.
  

Applicants requiring reasonable accommodations for the hiring interview process must request the necessary accommodations if scheduled for a hiring interview. The request should be made at the time of contact to schedule the interview. Questions regarding reasonable accommodations may be directed to the EEO contact listed on this job posting.


Desirable Qualifications In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

• Knowledge of Security Information & Event Management (SIEM) platforms and related logging.

• Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions.

• Knowledge of cyber threats, vulnerabilities, and incident handling methodologies.

• Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

• Knowledge of network security methodologies and computer networking concepts and protocols (e.g., TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services).

• Knowledge of what constitutes a network attack and a network attack's relationship to both threats and vulnerabilities.

• Knowledge of host/network access control mechanisms (e.g., access control list, capabilities lists).

• Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

• Knowledge of network mapping and recreating network topologies.

• Knowledge of system administration, network, and operating system hardening techniques.

• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

• Knowledge of Application Security Risks (e.g. Open Web Application Security Project Top 10 list).

• Knowledge of authentication, authorization, and access control methods.

• Knowledge of cloud service models and how those models can limit incident response.

• Knowledge of malware analysis concepts and methodologies.

Benefits
CDTFA appreciates and proudly celebrates diversity with an emphasis of an inclusive atmosphere in all levels of the organization. CDTFA is a participant in The Government Alliance on Race and Equity (GARE) Capitol Cohort to advance racial equality and advance opportunities for all in California. Employees of different races, ethnicities, genders, ages, religions, disabilities, gender orientations and personal experiences are welcomed to contribute to the success of CDTFA.


The CDTFA was presented with the Large State Employer of the Year Award for 2018 from The Association of California State Employees with Disabilities (ACSED); showcasing CDTFA's support of employment, promotion, and fair treatment of persons with disabilities.


CDTFA values its staff and is dedicated to employee career development. Our agency supports the development of staff by offering training to flourish in their position and programs to promote and explore upward mobility.

Working for the State offers great opportunities, generous benefits, and career development. In addition, you can look forward to:

• Nearby (third-party) parking.
• Convenient to public transportation.

For more information about the outstanding benefits offered to State Employees


Benefit information can be found on the CalHR website and the CalPERS website.



Contact Information
The Hiring Unit Contact is available to answer questions regarding the position or application process.
Department Website:
Hiring Unit Contact:
Jacob Kulikov
View phone number on click.appcast.io


Please direct requests for Reasonable Accommodations to the interview scheduler at the time the interview is being scheduled. You may direct any additional questions regarding Reasonable Accommodations or Equal Employment Opportunity for this position(s) to the Department's EEO Office.
EEO Contact:
EEO Contact
View phone number on click.appcast.io
View email address on click.appcast.io
California Relay Service: View phone number on click.appcast.io (TTY), View phone number on click.appcast.io (Voice) TTY is a Telecommunications Device for the Deaf, and is reachable only from phones equipped with a TTY Device.


Supplemental Questionnaire Requirement


Applicants must include a Supplemental Questionnaire (SQ) for this recruitment. Applications without an SQ or include an SQ that does not directly answer all the items below will not be considered. Resumes do not take the place of the SQ.

SQ Requirements:

• Name on SQ.
• Job Control number on SQ.
• SQ must be no more than two pages in length, single-spaced.

Respond directly to the following SQ question(s):

• Describe how you have addressed information security within an organization or enterprise. What steps, tools and procedures did you use to develop your security practices? What key decisions did you make? What was the outcome?

You must provide specific information in your response(s) which demonstrates how your knowledge, skills, and training meet the needs of this position.


Additional Instructions for Applicants
Using the online application system as specified in the announcement is the preferred method of applying for civil service job opportunities; however, applicants may instead apply by way of U.S. mail, parcel delivery or courier service, or in person, as set forth in this announcement.


Paper applications must include a signature. Dates printed on envelopes by mobile barcodes or equivalent mobile print technology are not acceptable proof of the date the application and any other required documents or materials were filed.


A completed state application (STD. 678) and any documents list under "Required Application Documents" must be submitted with your application package. Applicants who are relying on additional documentation (e.g. transcripts, copy of degrees, certifications, licenses, etc.) in order to prove that they meet the minimum qualifications listed in the Classification Specification (located on the right under "Additional Documentation) must submit those documents with their application package. Failure to submit these documents may result in your application being disqualified. Applications must include a description of the duties performed for each position held; reference to a resume in place of a description of the duties performed will not be accepted.

Applicants must state their basis of eligibility (List Eligibility, Lateral Transfer, Reinstatement, T&D, or Surplus/SROA), and the Job Control (JC) number and/or position number in the "Examination(s) or Job Title(s), For Which You Are Applying" section on the STD. 678. Surplus/SROA candidates should submit a copy of their letter with their application. Please remove any confidential information (i.e. social security number, date of birth, etc.) as well as any information regarding your LEAP eligibility and/or exam scores from your documents prior to submission.


Here is the link to the Information Technology Specialist I examination bulletin.

Here is the link to the Information Technology Specialist I (LEAP) examination bulletin.

If applying electronically, please note that CalCareers no longer allows applicants to withdraw their applications. If you need assistance to withdraw your application, please contact the Certification Section at View email address on click.appcast.io


For all other questions regarding your CalCareer account, please contact CalHR's CalCareers Unit at View phone number on click.appcast.io or View email address on click.appcast.io .


For more information on the recruitment process please email View email address on click.appcast.io


Equal Opportunity Employer
The State of California is an equal opportunity employer to all, regardless of age, ancestry, color, disability (mental and physical), exercising the right to family care and medical leave, gender, gender expression, gender identity, genetic information, marital status, medical condition, military or veteran status, national origin, political affiliation, race, religious creed, sex (includes pregnancy, childbirth, breastfeeding and related medical conditions), and sexual orientation.


It is an objective of the State of California to achieve a drug-free work place. Any applicant for state employment will be expected to behave in accordance with this objective because the use of illegal drugs is inconsistent with the law of the State, the rules governing Civil Service, and the special trust placed in public servants.