Information Security Specialist

Job Description and Duties

Under the general direction of the Security Operations Manager, an Information Technology (IT) Manager I of the California High-Speed Rail Authority (Authority), the IT Specialist II (Information Security Specialist) serves as a lead for the Enterprise Governance, Risk, and Compliance (GRC) section. The incumbent works independently and collaboratively to plan, implement, maintain, and oversee the Authority’s enterprise-wide GRC activities, with a strong focus on identifying, assessing, and managing information security risks. As a technical specialist within the Authority’s Information Security Program, the incumbent provides leadership in the development, documentation, and maintenance of information security policies, standards, and procedures; ensures effective configuration management practices; and coordinates enterprise reporting on governance, risk posture, privacy, and compliance performance.

The incumbent leads efforts to establish and maintain a consistent, repeatable risk management framework; ensures alignment with statewide and federal requirements; and drives integration of risk-based decision-making across IT and business units. Through expert-level guidance and oversight of risk identification, evaluation, mitigation, and monitoring activities, the incumbent strengthens the Authority’s security governance and elevates organizational risk awareness and accountability. These efforts enhance the Authority’s ability to manage enterprise security risk effectively and support the protection of critical assets in alignment with mission objectives.

You will find additional information about the job in the .

Working Conditions

Part-time telework is available for this position for California residents based on the requirements of the position and may be discussed during the interview process. Hiring interviews may be available virtually, using teleconferencing or video conferencing options.

While working on-site, the incumbent works in a professional office environment, in a climate-controlled area which may fluctuate in temperature and is under artificial light. The incumbent will be required to use a computer, mouse, and keyboard, and will be required to sit for long periods of time at a computer screen. The incumbent must be able to focus for long periods of time, multi-task, adapt to changes in priorities, and complete tasks or projects with short notice. The incumbent must develop and maintain cooperative working relationships and display professionalism and respect for others in all contact opportunities.

Special Requirements

A Statement of Qualifications (SOQ) is required for this position. The SOQ must be no more than three (3) pages, single-spaced, with one-inch margins, in 12-point font, organized and numbered as reflected below. The SOQ must discuss the applicant’s applicable experience as it pertains to each item below. Applicants who do not follow these requirements may be disqualified from the hiring process. A resume is required but does not take the place of the SOQ. Letters and other materials will not be considered in the place of the SOQ.

You must respond to all the following items:

1. Describe your experience drafting and maintaining IT or information security documents, such as policies, procedures, configuration guides, or security baselines. Provide specific examples.

2. Explain your familiarity with information security policies, standards, and frameworks such as SAM, SIMM, NIST SP 800-53/171, CIS Benchmarks, DISA, STIGs and how you have applied them in practice.

3. Provide an example of when you assisted with or prepared documentation for an audit, assessment, or compliance review. Explain your role and how your work contributed to the outcome.

4. Describe how you have communicated complex technical information to non-technical staff or stakeholders. What strategies did you use to ensure clarity and adoption?

5. Describe your experience conducting risk assessments and developing risk treatment plans. Include examples that demonstrate how you identified, analyzed, prioritized, or mitigated risks.

NOTE: Artificial intelligence (AI) tools such as ChatGPT, website searches, and third-party reviewers can be helpful in researching responses to the SOQ; however, by submitting your application for this position, you understand and acknowledge the SOQ you submit is your own work, in your own words, and accurately reflects your knowledge, skills, abilities, and experiences. Submitting an SOQ that is not your own may be cause for disqualification from the hiring process.

Desirable Qualifications

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

• Associate or bachelor’s degree in an IT-related field of study.
• 5 years of related experience in information security or an equivalent combination of education and experience.
• Possession of one or more of the following active certifications is desirable:
  • CompTIA Security+
  • CompTIA Cybersecurity Analyst+ (CySA+)
  • Certified Cloud Security Professional (CCSP)
  • Certified Information Security Auditor (CISA)
  • Certified Information Systems Security Professional (CISSP)
  • GIAC Continuous Monitoring Certification (GMON)
  • Microsoft Security Operations Analyst
  • AWS/Azure Security Engineer Associate
• Strong technical writing skills with the ability to produce security baselines, configuration guides, system documentation, and reports.
• Experience with system hardening and compliance frameworks such as CIS Benchmarks, DISA, STIGs, and NIST SP 800-53/171.
• Familiarity with enterprise IT environments including Windows Server, Linux, Active Directory, databases, and cloud platforms (Azure, AWS, M365).
• Hands-on experience working with IT infrastructure including routers, witches, servers, databases, and endpoint management.
• Hands-on experience with information security tools such as Security Information and Event Management (SIEM), vulnerability scanners (e.g., Tenable, Qualys), EDR platforms, and log management solutions.
• Knowledge of security devices such as network firewalls, web application firewalls, web content filters, and intrusion prevention/detection systems.
• Knowledge of networking concepts and practices.
• Knowledge of cybersecurity frameworks, governance risk assessments and compliance in the IT field.
• Ability to analyze documents to provide feedback and inform management of appropriate information.
• Understanding of scripting or automation (e.g., PowerShell, Python, or Bash) to assist with policy enforcement and evidence gathering.
• Experience authoring security policies, procedures, and other reference materials.
• Ability to adapt quickly to new tools, platforms, and security frameworks as technology and compliance requirements evolve.
• Ability to establish and maintain cooperative working relationships with all levels of staff and management; communicate effectively with peers, other technical teams, external partners, vendors, and others.
• Ability to manage multiple-high priority initiatives in a fast-paced achievement-oriented environment and work under pressure to meet deadlines.
• Ability to maintain confidentiality of sensitive tasks, assignments, and information.
• Willingness to work excess hours to achieve business results.
• Display enthusiasm for continous learning.

Benefits

The State of California offers a comprehensive benefits package that includes health, vision, dental, a retirement pension, a telework stipend if applicable, and an array of other options.

Benefit information can be found on the CalHR website and the CalPERS website.

Application Information

The STD. 678 is required, and each section must be filled out completely and thoroughly. Please do not include your Social Security Number, date of birth, veteran status, personal photos, LEAP information, or any other personally identifying information on any documents in your application package.

Using the online application system as specified in the announcement is the preferred method of applying for civil service job opportunities; however, applicants may instead apply by way of U.S. mail, parcel delivery or courier service, or in person, as set forth in this announcement. Dates printed on envelopes by mobile barcodes or equivalent mobile print technology are not acceptable proof of the date the application and any other required documents or materials were filed.

If applying via postal mail or by dropping off your application, applicants must include JC-526578 and Information Security Specialist, 311-420-1414-004 in the 'Job Title' section of the STD. 678 to be considered for this position. Please indicate on the STD 678 your basis of eligibility in the "Explanations" field (i.e. SROA, surplus, reemployment, reinstatement, transfer, or list eligible.)

Surplus/SROA candidates must provide a copy of their surplus/SROA letter with their application. Consideration may be given to applicants on another Department's employment list, provided the criteria are met to transfer the eligibility from the employment list to the Authority's employment list. Training and Development assignments are not being considered at this time.

NOTE: To be considered for this job opportunity, applicants must be reachable on an employment list, have transfer eligibility, or have reinstatement eligibility. If you are new to California State service and you do not have list eligibility, you must take the exam for this classification. To gain employment list eligibility, please  click here to access the exam bulletin.

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

• Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
• Resume is required and must be included.
• Statement of Qualifications - A Statement of Qualifications (SOQ) is required to apply. Please see above “Special Requirements” section for SOQ instructions.