IT Security Analyst

Information Technology (IT) provides technical services, manages the county's technical resources, and provides consulting services for technology improvements through three programs: Administration, Operations, and Technology Solutions. These programs provide a complete range of technology services, which include strategic planning, new service design, systems analysis, project management, security risk management, data security, applications delivery and support networks, servers and storage, desktop and mobile management, database administration, and end-user support.

GENERAL STATEMENT OF DUTIES
An IT Security Analyst will assist the IT Security Administrator in managing information security operations and functions; implement and support the development of related policies, procedures, and business practices; adhere to administrative controls and improvements; and follow procedures for new and changing regulatory requirements. Facilitate and coordinate throughout the county to achieve the objectives of the service plan.

SUPERVISION RECEIVED
Under general supervision of an IT Manager or designee who assigns work, establishes goals, and reviews the results obtained for overall effectiveness through analyzing work products, observations, and meetings. The IT Security Administrator will act as a lead worker.

SUPERVISION EXERCISED
This classification will act as a lead worker* to non-supervisory employees or in collaboration with other departments.

Works inter-departmentally to identify and correct flaws in the County’s security systems, solutions, and programs while recommending specific measures that can improve the County’s overall security posture. Plans, organizes, manages, and administers information security programs, operations, and functions. Assists in, develops, and maintains information security policies, procedures, and business practices. Leads security risk assessment efforts and supports the employee security-awareness training program. Evaluates security goals, objectives, priorities, and activities to improve performance and outcomes. Recommends and establishes physical, technical, and administrative security controls and improvements; serves as an advisor to the management team.

• Develops and maintains the framework for the County's IT information security program.
• Evaluates and recommends new information security technologies and counter-measures against threats to information or privacy.
• Identifies information technology security initiatives and standards for the enterprise.
• Manages the development, implementation, and maintenance of information security policy, standards, guidelines, and procedures.

• Maintains punctual and regular attendance.
• Establishes and maintains professional and effective working relationships with coworkers (team members), other agencies, and the public.
• Complies with all departmental and county policies and procedures.

• Monitor and maintain security tools/systems (not limited to)
  • Endpoint Threat Protection Monitoring (Devices with Antivirus)
  • Cloud Security Monitoring, alerts & reports
  • Advanced Threat Protection (ATP)
  • SIEM or other logging and correlation technologies
  • Vulnerability Scans for security and compliance
  • Vulnerability remediation assessment and planning
• Implement new security configurations.
  • Research security configuration enhancements and make recommendations to management.

• Monitor data access: ensure the internal control systems are monitored and that appropriate access levels are maintained following the principle of least privilege.
• Conduct security assessments through vulnerability testing and risk analysis using available vulnerability scanning tools.
• Assist with internal and external security audits.
• Ensure adopted security policies, procedures, and best practices are followed.
• Contribute to weekly security status reports to IT leadership.
  

• Analyze security breaches to identify the root cause.
• Respond to potential security policy violations or complaints from external parties.
• Assist in oversight and activities for intrusion detection and response.
• Investigate security incidents and develop after-action reports.
• Serve as a point of contact for external security auditors, survey requests, and for department security/privacy matters.
• Assists in facilitating, and promoting activities to create information security awareness and training.

• Participates in meetings, in-service training, workshops, etc. for the purpose of gathering information required to perform job functions.
• Other duties as assigned.

EXPERIENCE AND TRAINING

• Bachelor's degree with significant coursework in computer science, information technology, or a related field; AND
• Three years of progressive experience in cybersecurity and information security, including experience with internet technology and security issues; OR
• Any satisfactory combination of work, education, training, or experience relevant to the position, as determined by Marion County.

• The finalist for this position will be required to pass a criminal history background check, including fingerprinting; however, conviction of a crime may not necessarily disqualify an individual for this position.
• Must possess a current driver's license in the applicant's state of residence and an acceptable driving history. Marion County will obtain a copy of the driving record for all qualified applicants from Driver and Motor Vehicle Services and review the driving record according to the Marion County policy and procedure for Driving on County Business. The policy can be found at: http://apps.co.marion.or.us/APAP/.
• This is a full-time position, which is not eligible for overtime.
• This assignment is not represented by a union.
• Typical Work Schedule: Monday through Friday, 8:00 a.m. - 5:00 p.m., with flexibility depending upon the needs of the department and program.

• Certified Information Systems Security Professional (CISSP), or formal security certifications from (ISC)², GIAC, CompTIA, ISACA, CEH, PNPT, OSCP.
• Information security principles and practices, including any of the following: security risk assessment standards, risk assessment methodologies, and vulnerability assessments.
• Senior level knowledge of mainstream operating systems and a wide range of security technologies, such as network security appliances, identity, and access management (IAM) systems, anti-malware solutions, automated policy compliance tools, and desktop security software.

PUBLIC SERVICE LOAN FORGIVENESS
Marion County is a qualifying public employer for the Public Service Loan Forgiveness Program. Through the Public Service Loan Forgiveness Program, full-time employees working at the County may qualify for forgiveness of the remaining balance on Direct Loans after 120 qualifying monthly payments under a qualifying repayment plan. Questions about your loan eligibility should be directed to your loan servicer or the US Department of Education.

VETERANS’ PREFERENCE
Applicants are eligible to use Veterans’ Preference when applying with Marion County in accordance with ORS 408.225, 408.230, and 408.235 and OAR 105-040-0010 and 105-040-0015. Preference will be awarded only if the applicant meets the minimum requirements of the position and attaches the required documentation at the time of application.

DOCUMENTS REQUIRED FOR VETERANS’ PREFERENCE

• One of the following:
  • MEMBER COPY 4 of the Certificate of Release or Discharge from Active Duty (DD Form 214 or 215); OR
  • Letter from the US Department of Veterans Affairs indicating receipt of a non-service connected pension; OR
  • Certification that discharge or release from active duty under honorable conditions will take place not later than 120 days after the submission of the certificate.

• In addition to one of the above documents, Disabled Veterans must also submit one of the following:
  • A copy of their Veterans disability preference letter from the Department of Veterans Affairs; OR
  • Certification that medical separation from active duty under honorable conditions will take place not later than 120 days after the submission of the certificate.

You can request copies of your military service record through the National Archives website at http://www.archives.gov/veterans/military-service-records/

Marion County is an Equal Opportunity, Affirmative Action, Veteran and Disability employer committed to increasing the diversity of its workforce.