Cybersecurity Analyst

Position Summary Hello, we’re Metro! Metro is dedicated to shaping a better future for the greater Portland region. The work the people of Metro do every day benefits the lives of the people who live here, today, and tomorrow. The Information Security Team is looking for a Senior Cybersecurity Analyst to lead technical security operations, detection engineering, and incident response for Metro, protecting the systems, data, and services that people across the greater Portland region rely on every day. The Senior Cybersecurity Analyst is the primary technical lead for Metro's security operations, detection engineering, and technical control execution, leading hands‑on threat detection, incident response, and continuous improvement of Metro's security posture across endpoint, identity, cloud, and network environments. This role serves as a senior technical control operator for compliance frameworks (NIST CSF, CIS Controls, PCI DSS) in partnership with the Information Security Compliance Analyst, who leads control definition and governance, and acts as the technical incident lead during security events, with formal incident declaration owned by the CISO. As Metro's Information Security program matures, this position offers a clear growth path toward a future Principal Cybersecurity Analyst role with broader ownership of security architecture, detection strategy, and technical risk leadership. As the Senior Cybersecurity Analyst you will Serve as the CISO's primary technical lead for security operations, leading alert review, validation, escalation, and coordinated response for security events across Metro's environment. Act as technical incident lead during security events, coordinating containment, eradication, recovery, and post‑incident follow‑up in partnership with the CISO, IT teams, and SOC/MSSP providers. Develop, tune, and optimize detection content across SIEM, EDR, identity, cloud, and network security tools, incorporating threat intelligence and MITRE ATT&CK techniques. Operate and improve vulnerability management processes, providing risk‑based prioritization and partnering with the Compliance Analyst on remediation tracking and risk acceptance documentation. Implement, configure, and monitor technical safeguards under NIST CSF, CIS Controls, and PCI DSS, generating evidence to support compliance validation and audit activities. Own technical security review and ongoing oversight of third‑party services, SaaS platforms, and vendor integrations, evaluating authentication, data flows, and integration risk. Monitor Metro's identity security posture, tune identity threat detection tooling, and investigate identity‑based threats such as credential theft and lateral movement. Maintain secure configuration baselines using CIS Benchmarks, administer Metro's EDR platform, and participate in security architecture and design reviews for cloud and infrastructure changes. Implement and operate data protection controls (DLP, data monitoring, and audit capabilities), investigating alerts and partnering with the Compliance Analyst to align technical enforcement with policy intent. Contribute technical content to security standards and training materials, and identify opportunities to improve detection quality, control effectiveness, and operational efficiency. Attributes for success Technically curious with a strong drive to learn, improve, and expand security capabilities across endpoint, identity, cloud, and network domains. Detail‑oriented with strong analytical skills and a disciplined approach to detection engineering, evidence collection, and documentation. Comfortable leading technical incident response under pressure, exercising sound judgment about when to elevate versus resolve. Strong working knowledge of security frameworks (NIST CSF, CIS Controls, PCI DSS) with the ability to translate requirements into practical technical controls. Collaborative mindset with the ability to partner effectively with the Compliance Analyst, IT Infrastructure, Applications teams, Metro departments and business partners, and third‑party SOC/MSSP providers. Able to work independently on assigned technical priorities while communicating clearly with both technical and non‑technical stakeholders. Comfortable with ambiguity and program‑building, given that tooling, processes, and governance structures are still actively maturing. Reliable and responsive as a technical escalation point for high‑severity or time‑sensitive security events. Growth‑oriented, with the interest and capability to progress toward broader ownership of security architecture, detection strategy, and technical risk leadership. Genuine interest in continuous learning and staying current on evolving threats, tooling, and best practices in a public‑sector context. DIVERSITY AND INCLUSION At Metro, we strive to cultivate diversity, advance equity, and practice inclusion in all of its work. This means attracting and empowering a workforce that is inclusive of a broad range of human qualities. Workplace diversity is both a moral imperative and a business strength, essential to providing quality support and services to our region. Metro’s goal is to hire, develop and retain highly skilled and talented individuals across all departments and programs who best reflect the diversity of our community. TO QUALIFY We will consider any combination of relevant work experience, volunteering, education, and transferable skills as qualifying unless an item or section is labeled required. Please be clear and specific in your application materials on how your background is relevant. Minimum Qualifications 4-6 years of related professional experience in cybersecurity, security operations, detection engineering, incident response, vulnerability management, identity and access management, network security, cloud security, or a related technical field. Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education, certification, and related professional experience. Any combination of education, professional, volunteer and lived experience that provides the necessary knowledge, skills, and abilities to perform the classification duties and responsibilities. If this statement is true for you, then you may be ineligible to apply If you were terminated for cause during any employment with Metro, or resigned in lieu of termination, you may be ineligible for rehire for a minimum of 3 years. Hybrid Telework This position is designated as “hybrid telework.” You will be required to work onsite and at times have the option to work away from your assigned work location. The specific schedule and balance of onsite and telework will be discussed with the hiring manager at the time of offer. This position also requires off‑hours response to security events, incidents, or urgent operational needs, which may include remote response and onsite response when necessary. Employees must reside in Oregon or Washington to work at Metro. Please note, the designation of hybrid telework may be subject to change at a future time. Like To Have Qualifications You do not need to have the following preferred qualifications/transferable skills to qualify. However, keep in mind we may consider them when identifying the most qualified candidates. Your transferable skills are any skills you have gained through education, work experience, including the military, or life experience that are relevant for this position. Demonstrated experience with technical control implementation, endpoint protection, identity security, network security, cloud security, logging, monitoring, or compliance‑related safeguards. Working knowledge of cybersecurity frameworks and control practices, including NIST CSF, CIS Controls, PCI DSS, or similar risk‑based security frameworks. Strong written and verbal communication skills, including the ability to document findings, procedures, and technical recommendations for both technical and non‑technical audiences. 6 or more years of progressively responsible cybersecurity or closely related technical experience, including senior‑level ownership of security operations, detection engineering, incident response, or enterprise security controls. Demonstrated ability to grow into principal‑level responsibility for security architecture, detection strategy, and technical risk leadership. Experience in public sector, local government, or critical infrastructure security environments. Hands‑on experience with CrowdStrike Falcon modules (EDR, NG‑SIEM, Identity Protection, or Exposure Management). Familiarity with Palo Alto Networks firewall administration or network security monitoring. Experience with Microsoft Entra ID, Active Directory, or cloud identity and access management in AWS or GCP environments. Familiarity with the MITRE ATT&CK framework and its application to detection and threat hunting. Preferred certification: CISSP. Other relevant certifications may include: Security+, CySA+, SSCP, GSEC GCIA, GCIH, or CEH SCREENING AND EVALUATION The application packet: The application packet consists of the following required documents. Please ensure that you upload these documents in your online application. Make sure your application is complete, missing any part of these items could result in an incomplete application and will not be moved forward in the recruitment. A completed online application Responses to supplemental questions The selection process: Initial review of minimum qualifications In‑depth evaluation of application materials to identify the most qualified candidates Consideration of top candidates/interviews Testing/assessments Reference check Background records check Compensation, Benefits And Representation The full‑salary range for this position is step 1: $94,106.41 to step 7: $126,142.16. However, unless a candidate’s qualifications justify, based on the Oregon Pay Equity Act requirements and Metro’s internal equity review process, the appointment will likely be made between step 1: $94,106.41 to the equity range step 4: $108,947.96. This position is not eligible for overtime and represented by AFSCME 3580 union. It is classified as a Systems Administrator III position. Classification descriptions are typically written broadly and do not include the specific duties and responsibilities of the positions. View the classification description. Additional Information Equal employment opportunity All qualified persons will be considered for employment without regard to race, color, religion, sex, national origin, age, marital status, familial status, gender identity and expression, sexual orientation, disability for which a reasonable accommodation can be made, or any other status protected by law. Non-discrimination?in hiring decisions Metro is committed to equal employment?opportunity?and?complies with?all applicable federal, state, and local civil rights laws. Metro employment decisions – including recruitment, screening, interviewing, selection, promotion, compensation, and separation – must not discriminate based on race, color, national origin, ethnicity, religion, sex, sexual orientation, gender identity, disability, age, veteran status, or any other protected class.?? Accommodation Metro will gladly provide a reasonable accommodation to anyone whose specific disability prevents them from completing this application or participating in this recruitment process. Please contact the recruiter outlined in the job announcement in advance to request assistance. Veterans' preference Under Oregon Law, qualified veterans may be eligible for veterans' preference when applying for Metro positions. If you are a veteran and would like to be considered for a veterans' preference for this job, please provide qualifying documents as instructed during the application process. Hybrid Telework This position is designated as “hybrid telework.” You will be required to work onsite and at times have the option to work away from your assigned work location. The specific schedule and balance of onsite and telework will be discussed with the hiring manager at the time of offer. This position also requires off‑hours response to security events, incidents, or urgent operational needs, which may include remote response and onsite response when necessary. Employees must reside in Oregon or Washington to work at Metro. Please note, the designation of hybrid telework may be subject to change at a future time. Pay equity at Metro No matter who you are or where you work at Metro, you deserve to be paid fairly for the work you do. Every worker must get equal pay for equal work regardless of your gender, race, age, or other protected characteristics. Metro has established processes and conducts routine pay equity reviews as part of the hiring process to ensure compliance with the 2017 Oregon Pay Equity Act. Online applications Metro accepts job applications online. If you need assistance or accommodation with your application, or access to a computer, please contact the recruiter outlined in the job announcement in advance to request assistance. Metro Led by an elected council, this unique government gives all residents of greater Portland a voice in shaping the future and provides parks, venues, services, and tools at a regional scale. We find solutions for our area’s garbage and recycling that protect clean air and water; help plan land use and development to provide jobs and safe transportation; manage local venues that provide a connection to arts and culture and help keep the economy growing; protect 17,000 acres of parks and natural areas, and run the Oregon Zoo, to keep nature close to home. As part of the Metro family, you play a vital role in serving the people of the greater Portland region. Family members, including eligible spouses, domestic partners, and children, are covered under most of our benefits programs. Benefits vary depending on position and full‑time, part‑time, and variable hour status. This is a budgeted, regular status position with a full‑time schedule. The position is eligible for these benefits: Medical, dental and vision health insurance Paid sick leave Paid vacation, holiday, and other leave Paid parental leave Full contribution to Oregon PERS retirement No-cost TriMet Hop Pass Employee Assistance Program Training opportunities Flexible schedules depending on position and department Hybrid/Telework living in Oregon /Washington depending on position and department Metro also offers a variety of perks for all employees, including free admission to the Oregon Zoo (including ZooLights!), Oxbow and Blue Lake Regional Parks, membership discount at Lloyd Athletic Club, credit union eligibility and more. Employees also receive access to financial wellness and legal consultation services, as well as first‑time home buying and ownership counseling. Benefits Learn more about employee benefits. Some positions are represented by a union and have additional benefits. View union contracts here. 01 Describe your experience supporting or responding to a cybersecurity incident. What was your role, what actions did you take, how did you coordinate with others, and what was the outcome or lesson learned? 02 Describe your experience with security monitoring and detection improvement. Include examples of tuning detections, improving alert quality, or working with tools such as EDR, SIEM, identity, cloud, or network security platforms. 03 Describe your approach to vulnerability management. How do you assess risk, prioritize remediation, communicate findings, and track follow‑through? 04 Describe your experience implementing, supporting, or assessing technical security controls. You may reference frameworks such as NIST CSF, CIS Controls, PCI DSS, or similar standards if applicable. 05 Provide an example of how you have communicated technical security risks, recommendations, or tradeoffs to non‑technical partners or leadership. 06 Metro requires employees to reside in Oregon or Washington. This position also requires off‑hours response to security events, incidents, or urgent operational needs, which may include remote or onsite response when necessary. By checking "Yes" below you are acknowledging that you understand this role requires off hours and remote responses when necessary. Yes Required Question #J-18808-Ljbffr