Information Technology Security Analyst

Information Technology Security Analyst

Superior Court of California County of Contra Costa Announces an Open recruitment for: Information Technology Security Analyst $84,538.06 - $107,893.97 annually Final Filing – 5:00 pm Thursday, July 16, 2026 The Court is conducting an open recruitment for the classification of Information Technology Security Analyst. Under the direction of the Chief Information Security Officer, the Information Security Analyst supports the protection of court information systems, case-management platforms, and sensitive judicial data. The analyst monitors systems for threats, assists with incident response, and helps maintain compliance with statewide judicial security standards. Only applicants who meet the minimum qualifications by the final filing day may apply. Regular and punctual attendance is essential.

Duties that may be assigned include, but are not limited to, the following:

• Network Monitoring — Monitor court networks, servers, and applications for suspicious activity or security breaches.
• Incident Response — Investigate alerts, document incidents, and escalate issues to senior analysts when needed.
• Security Tools Management — Assist with operating firewalls, endpoint protection, encryption tools, MDM, and SIEM platforms.
• Vulnerability Management — Coordinate monthly vulnerability assessments, maintain the vulnerability dashboard, and collaborate closely with the IT team to prioritize and track patching remediation.
• Policy & Compliance Support — Help maintain security policies aligned with Judicial Council standards and statewide IT governance such as CJIS, CLETS, and NIST 800-53 best practices.
• Security Awareness & Compliance — Administer simulated phishing campaigns, analyze results, and conduct user follow-ups. Track compliance for mandatory cybersecurity and AI training, and ensure staff sign-off on the Information Systems Security Policy (ISSP).
• Email Security Operations — Triage suspicious email reports, verify legitimacy, and perform block or remediation actions directly within the Microsoft 365 tenant.
• Documentation & Reporting — Prepare reports on findings, risks, and recommended improvements.
• Physical Security – Security camera and physical access management. Assist with camera password change and network segmentation. Security footage requests.
• Audit Responsibilities - Conduct regular reviews of privileged access (PIM), monitor Microsoft 365 and on-premises environments for unusual admin connection attempts, conduct general access review (M365/On-prem), verify and monitor MFA activation states, and perform periodically installed software reviews.

The IDEAL CANDIDATE should have knowledge of:

• Foundational Cybersecurity Knowledge --Information Security Principles — CIA triad, threat types, risk, controls. --Common Attack Vectors — phishing, malware, ransomware, credential attacks. --Security Best Practices — Principle of least privilege, patching, secure configuration.
• Systems & Network Knowledge --Windows Security — Active Directory basics, permissions, event logs. --Linux Security — file permissions, system logs, SSH hardening. --Networking Fundamentals — TCP/IP, ports, protocols, firewalls, VPNs, and network segmentation (e.g., isolating IoT/security camera networks). --Cloud Security Basics — identity and access in Azure/Entra ID, shared responsibility model, cloud workload migration basics, and MDM (Mobile Device Management) concepts. --One or more scripting languages (e.g., PowerShell, Python and bash).
• Security Operations (SOC) Skills --SIEM Monitoring — log analysis, alert triage, correlation rules. --Incident Response — detection, containment, documentation, escalation. --Endpoint Protection — EDR tools, malware detection, remediation steps. --Vulnerability Scanning — interpreting scan results, prioritizing fixes. --Email Security & Phishing Triage — Analyzing email headers, recognizing phishing indicators, and executing tenant-level blocks or remediation. --Identity & Access Management --IAM Concepts — authentication, authorization, MFA, provisioning. --Identity Auditing — Practical knowledge of privileged access reviews (PIM), Active Directory/Azure account monitoring, and MFA activation tracking. --Role Based Access Control — applying least privilege in a court environment.
• Public Sector & Court Specific Knowledge --Judicial Data Sensitivity — sealed records, confidential case files. --Government IT Governance — compliance, audits, documentation. --Change Management — structured updates, approvals, tracking. --CJIS Compliance Framework — Understanding of Criminal Justice Information Services (CJIS) standards, specifically regarding authorized access controls and software compliance.
• Tools & Technologies --SIEM Platforms — Splunk, Sentinel, Huntress (even basic familiarity). --Ticketing Systems — ServiceNow, Jira, Cherwell. --Vulnerability Scanners — Nessus, Qualys, Forta, OpenVAS. --Endpoint Security Tools — CrowdStrike, Defender for Endpoint, and Microsoft Intune (MDM). --Soft Skills & Professional Competencies --Analytical Thinking — interpreting logs, identifying patterns. --Technical Writing — documenting incidents clearly for executive review. --Communication Skills — explaining security issues to non-technical staff. --Ethical Judgment — handling confidential judicial information responsibly.

Education and Work Experience at one of the following levels:

• A Bachelor's Degree in computer science, information systems or a closely related field and two (2) years' experience in the fields of cybersecurity, systems administration, operating systems, network analysis and/or management or similar field in a multi-platform information systems environment.
• An Associate's Degree in computer science, information systems or a closely related field and four (4) years' experience in the fields of cybersecurity, systems administration, operating systems, network analysis and/or management or similar field in a multi-platform information systems environment.
• An Associate's Degree in computer science, information systems or a closely related field and CompTIA Security+, Cybersecurity Analyst+, Cybersecurity and Infrastructure Security Agency (CISA), or equivalent certification and two (2) years' experience in the fields of cybersecurity, systems administration, operating systems, network analysis and/or management or similar field in a multi-platform information systems environment. Any Combination of experience and education that would provide the required knowledge and abilities is qualifying.

Working Conditions

• Primary work location: Martinez, CA, with occasional travel to other Contra Costa County courthouses (Richmond, Pittsburg, Walnut Creek).
• Fast-paced environment supporting judges, clerks, and justice partners.
• Handling of confidential, sealed, and sensitive case information.
• Occasional after-hours or on-call support during security incidents

Conditions of Employment Successful completion of fingerprint and a criminal record background check is required prior to appointment and is a condition of employment. Because the Court operates in multiple branches, the employee may be required to travel to other court locations, and possession of a valid California driver's license or the ability to travel between court locations independently is therefore required. All employees of the court who operate a vehicle on court business must certify they possess a valid California Driver's License and required levels of automobile insurance. Felony and misdemeanor convictions MAY BE disqualifying for employment with the court. The court will assess the nature and gravity of the offense, the time that has elapsed since the offense was committed, and the nature of the job duties to be performed. In accordance with the Immigration Reform and Control Act of 1986, all persons hired after November 6, 1986, are required to present to the Court, at the time of appointment, original documents which show satisfactory proof of: 1.) identity and 2.) U.S. Citizenship or a legal authorization to work in the United States. This position is an exempt, unrepresented position. The Court will make reasonable accommodations so applicants with disabilities may participate in the recruitment process. Please advise Human Resources at View phone number on click.appcast.io of special needs in advance. The Court is an equal opportunity employer. The Court provides equal employment opportunity at all times and does not discriminate in violation of applicable law.