Cyber Security Analyst

Cybersecurity Analyst

Under general direction, incumbent is responsible for protecting the school district's technology systems, networks, and data from unauthorized access and malicious threats. This includes monitoring security incidents, responding to breaches, managing security controls, and ensuring compliance with all relevant security protocols. The analyst also plays a role in fostering a security conscious culture among students and staff. Incumbent may travel to the various district sites.

Essential Functions:

• Threat detection and analysis: Actively monitor security alerts from various sources, including Security Information and Event Management (SIEM) systems, endpoint detection tools, and firewalls, etc.
• Incident response: Investigate and respond to security incidents such as malware infections, data breaches, and phishing attempts. Document root cause/incident response and report on all efforts.
• Security management: Assist in the management of security measures, including firewalls, endpoint protection, intrusion detection systems, and access controls.
• Vulnerability management: Conduct regular vulnerability scans and risk assessments to identify weaknesses in the district's IT infrastructure. Research and recommend solutions to mitigate identified vulnerabilities and work with staff to address them.
• Security strategy: Contribute to the development and implementation of the district's overall cybersecurity strategy, including disaster recovery and backup methodologies.
• User education and awareness: Develop and deliver security awareness training to faculty, staff, and students. Promote security best practices for handling sensitive information across the district. Communicate with users regarding potential security violations and new security products or procedures.
• Collaboration: Work collaboratively with other IT staff, administrators, and external vendors to maintain a secure and efficient technology environment.
• Performs other job related duties as assigned.

Required Qualifications:

• High School diploma or equivalent (G.E.D.) prior to being hired;
• Valid Arizona Department of Transportation Driver's License;
• Minimum of one year of experience in information security, network security, or a related technology field.
• Strong understanding of network protocols, operating systems (Windows, macOS, Chrome OS), and cloud services.
• Experience with security tools, including SIEM, antivirus software, and intrusion detection systems.
• Obtain and maintain a valid Arizona Identity Verified Prints (IVP) Fingerprint Clearance Card (AZ IVP FPCC).

Preferred Qualifications:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field; or an equivalent combination of education and experience demonstrating the necessary expertise.
• Relevant cybersecurity certifications such as CompTIA Security+, Certified Ethical Hacker (CEH), or CISSP.
• Experience working in an educational or public sector environment.
• Knowledge of emerging security technologies and trends.
• Experience administering a Cisco Local and Wide area networking environment;
• Experience with border network security devices such as Email filters and Firewalls;
• Experience administering Windows Server and Active Directory.
• Experience with VMWare and Veeam (or other backup and recovery platform)

Knowledge and Skills Required:

• Ability to work independently and collaboratively in a team environment.
• Proficiency with a range of security tools, such as SIEMs (e.g., Splunk), intrusion detection/prevention systems (IDS/IPS), and endpoint security solutions.
• Familiarity with scripting languages like Python or PowerShell for automating security tasks.
• Knowledge of common security frameworks, such as NIST.
• Understanding of networking concepts, firewalls, and data encryption techniques.
• Strong communication skills are essential for explaining complex technical topics to both technical and non-technical audiences.
• Excellent analytical, problem-solving, and communication skills, both written and verbal are critical for investigating security alerts and identifying vulnerabilities.
• Strong attention to detail is necessary for detecting subtle changes in network performance that may indicate a cyberattack.

Physical Requirements:

While performing the duties of this job, the employee is regularly required to sit; use hands to finger, handle, or feel; reach with hands and arms; and talk or hear. The employee frequently is required to walk. The employee is occasionally required to stand; climb or balance; stoop, kneel, crouch, or crawl; and taste or smell. The employee must regularly lift and/or move up to 10 pounds and frequently lift and/or move up to 50 pounds. Specific vision abilities required by this job include close vision, color vision, and ability to adjust focus.

Working Conditions:

While performing the duties of this job, the employee can be exposed to varying extremes of temperatures. The noise level in the work environment is usually quiet, but in some areas like mechanical and data center rooms, the noise level can be elevated to loud levels.