IT Security Specialist

Work Hours:  Monday – Friday, 8:00 A.M. – 4:30 P.M. (EST)
*Hours may vary due to work assignments, or projects.*

Work Location:  The Edney Innovation Center
1100 Market Street

FLSA Status:  This is an Exempt position.

Salary: GS.11 $58,910- $71,170

Department:  Technology Services

CLASSIFICATION SUMMARY:  

Incumbents plan and implement security measures to protect the City's computer systems, networks, and to ensure the confidentiality, integrity, and availability of City data. The IT Security Analyst II performs risk assessments and tests data processing systems. This role creates, tests, and implements network disaster recovery plans. It also involves regularly reviewing logs for breaches or suspicious activity and ensuring that data encryption and other necessary security measures are in place. The IT Security Analyst II is expected to stay current on the latest intelligence, including hackers' methodologies, to anticipate security breaches. This position acts as a forward-thinking innovative security architect that can effectively protect existing networks by researching, identifying, and recommending security enhancements.

SERIES LEVEL: 

The IT Security Analyst 2 is the second level of a three-level series.

ESSENTIAL FUNCTIONS:

(The following duties ARE NOT intended to serve as a comprehensive list of all duties performed by all employees in this classification, only a representative summary of the primary duties and responsibilities. Incumbent(s) may not be required to perform all duties listed and may be required to perform additional, position-specific duties.)

Perform the day-to-day IT security operations of the City's IT Security team including: auditing server and network access, audit server and network equipment patch levels, reviewing logs, documenting vulnerabilities and plan resolution, and ensuring security systems are online and enforced. 

Monitor and maintain physical and logical access controls on IT Security equipment and user account policies.

Ensures IT assets are secure. 

Gather and analyze information from departments to determine and set disaster recovery operations. 

Audit IT security measures and user account access levels to achieve maximum effectiveness of IT systems and users.

Assist and advise the Director of Infrastructure, Security and Camera Operations on matters pertaining to strategic and action plans for IT security, disaster recovery, penetration testing, use policy, IT change management, and other IT security related matters.

Assess potential technical solutions for IT security best practices.

Conduct  threat monitoring and analysis using various threat detection, investigation and response (TDIR) capable tools, such as security information and event management (SIEM) and extended detection and response (XDR) platforms. 

Conduct multi-telemetry based threat investigations to identify cyber threats coming both internally and externally of the organization. 

Triage alerts from detection platforms, identifying and removing false positive issues and escalating genuine identified attacks.

Document formal, technical incident reports for consumption by infrastructure teams and senior leadership.

Provide infrastructure teams with incident support, including mitigating actions to contain activity and advisory for remedial actions.

Work with threat detection content development teams to enhance/tune detection platforms, and create new detection content.

Carry out root cause analysis and investigations to advise on prevention mechanisms and configuration changes.

Work with Threat Intelligence teams to research emerging threats and exploits to aid in the discovery of incidents. Maintains knowledge of latest security technologies and mitigations.

Work with threat hunting teams to optimize TDIR capabilities through threat hunting findings.Supports the development and running of reporting for compliance and infrastructure teams as well as performance reporting for the security operations team.

Carry out analysis and testing for the purposes of identifying vulnerabilities, misconfigurations or other exposures, and the validation of user policies.

Must meet regular attendance requirements.

Must be able to maintain good interpersonal relationships with staff, co-workers, managers, and citizens.

Must accomplish the essential functions of the job, with or without reasonable accommodations, in a timely manner.

Performs other duties as assigned.

DEPARTMENT SPECIFIC DUTIES (if any):

MINIMUM QUALIFICATIONS:

Bachelor's Degree or equivalent education and work experience with training e