Information Security Architect

Job Description and Duties

Under the administrative direction of the Information Technology Manager II (IT Mgr II), the Information Technology Specialist III (IT Spec III) serves as the Office of Information Security's (OIS) Lead Data Architect for the Security Operations Center (SOC). The IT Spec III is responsible for the architecture, design, development, integration, and management of the large-scale security data platform that supports the agency's threat detection, incident response, and cyber defense mission. The IT Spec III leads data architecture and data modeling efforts to establish efficient, secure, and scalable methods for collecting, storing, correlating, and reporting high-volume security telemetry across a multi-tenant environment, and designs the data lake/lake house foundation that enables advanced analytics, machine learning, and AI-enabled and agentic automation for security operations. This is accomplished through the delivery of services across IT domains including Software Engineering, System Engineering, Information Security Engineering, and IT Project Management, and through the IT Spec III's leadership of the on-premises AI compute platform used to fine-tune, evaluate, and serve the machine learning and large language models supporting Tier 1 security operations.

The IT Spec III works independently or collaboratively, and acts in a lead capacity to plan and coordinate technology solutions addressing the agency's most complex security problems, including the expansion of SOC services to additional state, local, and critical-infrastructure partners, and the engineering of AI-assisted detection, triage, and threat-hunting capabilities. Additionally, the IT Spec III solicits and considers internal and external customer input when completing work assignments in the Security Solutions Operations Unit, and maintains ongoing contact with technical, administrative, and managerial staff across CDT and customer organizations. The technologies supporting these functions include Microsoft Azure (Microsoft Sentinel, Log Analytics, Azure Data Lake Storage); Databricks, Delta Lake, and Apache Spark; Kusto Query Language (KQL); Microsoft Defender XDR; MS SQL Server and T-SQL; Python (including PySpark); data pipeline/ELT tooling; REST and GraphQL web services and APIs; JSON and XML; Power BI, Power Apps, and Power Automate; containerization (Docker) and version control (GitHub); large language model (LLM) and agentic AI frameworks; and Red Hat Linux and Windows Server.

Telework

This position is eligible for a hybrid work schedule within California based on departmental policy and operational needs. The telework policy is subject to change depending on business needs, and/or reporting to the work site may be required with minimal notification given. Pursuant to Executive Order, effective July 1, 2025, employees in this position will be required to report to the work site a minimum of two (2) days per week, increasing to four (4) days per week effective July 1, 2026. The specific on-site days will be determined by the department based on operational requirements.

Visa Sponsorship

Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

You will find additional information about the job in the .

Special Requirements

All interested applicants are required to submit a Statement of Qualifications (SOQ) . You must provide direct responses to each of the numbered items listed below. Each individual response must be numbered and include the full text of the numbered items prior to your response. Please include specific examples of your education, training, and/or experience. Limit your SOQ to a maximum of three (3) pages, single-spaced, twelve-point Arial font. Applicants who do not follow these instructions may be disqualified from the selection process. Cover letters and résumés do not take the place of the SOQ.

The SOQ serves as a key component of the examination and hiring process and will be used to evaluate your qualifications, as well as your written communication skills. The SOQ is considered a writing sample and must clearly reflect your own knowledge, skills, abilities, and experience. While tools such as artificial intelligence (AI) (e.g., ChatGPT), internet resources, or third-party reviewers may assist with research or preparation, by submitting your application you certify that your SOQ is your original work, written in your own words, and accurately represents your background and qualifications. Failure to submit an SOQ that is your own work, including the use of AI-generated or substantially AI-assisted responses that misrepresent your abilities, may result in disqualification from the examination or hiring process. If such misrepresentation is discovered after appointment, it may constitute dishonesty and could result in adverse action, up to and including dismissal from State service.

1. Describe your experience designing, building, or operating on-premises or cloud-based AI/ML infrastructure used to fine-tune, evaluate, and serve models in a production environment. Describe how you have kept sensitive data in-state or in-environment while meeting generative AI risk and data-handling requirements.
2. Describe your experience serving as the accountable lead for data architecture standards on a security platform, including reviewing or approving system design specifications such as entity relationship diagrams, data models, or database/lakehouse schemas. What was your process for ensuring design consistency across a team or organization?
3. Describe your experience applying AI or machine learning capabilities to a security operation or threat detection workflow (e.g., automated alert triage, anomaly detection, analyst-assist tooling). What risks or limitations did you have to account for when introducing AI into that workflow, and how did you address them.

Do not submit the “Equal Employment Opportunity” questionnaire (page 5) with your completed state application (STD. 678) – For exam use only.

Please do NOT include your Social Security Number on any of the submitted documents.

Desirable Qualifications

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

• Experience designing or supporting large-scale security data platforms, including multi-tenant or enterprise environments
• Experience understanding of SIEM concepts, security telemetry, log management, and data correlation strategies
• Experience using query languages or search engines to analyze high-volume security data (such as proficiency in KQL, SQL, or equivalent technologies)
• Experience building or maintaining data pipelines, streaming ingestion frameworks, or ELT/ETL processes
• Experience architecting data lake or lake house environments, including schema design and optimization
• Experience applying machine learning or automation concepts within security operations workflows
• Experience planning, implementing, or supporting on-premises or cloud-based AI/ML infrastructure
• Experience integrating data from diverse security platforms such as endpoint protection, identity systems, network detection tools, or SIEM/SOAR technologies
• Ability to translate complex technical data concepts to non-technical audiences
• Experience leading technical teams or providing subject matter guidance in data architecture or security engineering
• Analytical skills, including the ability to identify patterns, detect anomalies, and evaluate data quality issues
• Experience developing or maintaining data governance frameworks, including access controls, auditing, and compliance documentation
• Ability to manage competing priorities across multiple complex projects
• Experience with scripting or programming languages commonly used for data processing (such as Python, R, or equivale nt)

Benefits

Benefit information can be found on the CalHR website and the CalPERS website.

Additional Application Instructions

Using the online application system as specified in the announcement is the preferred method of applying for civil service job opportunities; however, applicants may instead apply by way of U.S. mail, parcel delivery or courier service, or in person, as set forth in this announcement.

Applicants who wish to submit hard copy applications shall use the most current version of the State Application (STD. 678) revised 10/2023. The position number and job control number must be identified in the job title line of the STD 678 (these numbers will auto-populate in the job title of the STD 678 if submitting an electronic application through CalCareers Account). The hard copy application MUST be signed. Applicants who fail to submit the most current version of the STD. 678 may be disqualified.

Note: Applications MUST include the “From dates“ and “To” dates, “Hours Per Week”, and “Duties Performed” fields for all job listed in the “Employment History” fields, and contact names and phone numbers of supervisors. State employees must list the specific departments for which they worked and indicate the specific civil service classification titles held (not working titles). Applications that are submitted blank will be considered incomplete. Reference to a resume in place of a description of the duties will not be accepted. Failure to submit a completed STD 678 may result in you being screened out. Only the most qualified candidates will be invited to an interview.

Please note that the CalCareer system will not allow you to make changes to your application information once it is submitted. For all other questions regarding your CalHR CalCareer account, you may contact the CalCareer Unit at View phone number on us.fitly.work.

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is required and must be included.
• Statement of Qualifications -

  Required. Please see “Special Requirements” section for further information.