Cybersecurity Analyst I/II/III

Description

Our Cybersecurity Analyst  is a hands-on cybersecurity professional who is dedicated to maintaining the confidentiality, integrity and availability of Cabrillo Coastal’s information systems and data and helps protect the Company’s systems, networks, applications, data and users from cybersecurity threats. This position provides broad technical security support across the organization by investigating security incidents, administering cybersecurity technologies, identifying and evaluating risks and partnering with other technology teams to implement effective safeguards and corrective actions. 

In the spirit of our Company’s mission, values and culture, the duties listed below serve as illustrations of the various types of work that may be performed by our Cybersecurity  Analysts I/II/III. We also expect our Cybersecurity  Analysts I/II/III to carry out other responsibilities that are similar, related or a logical assignment to this job class.

• Leads and/or performs investigations of suspected cybersecurity incidents, including phishing, compromised accounts, malicious software, ransomware, unauthorized access, suspicious endpoint activity, data exposure and other potential security events.

• Reviews, analyzes and correlates alerts and technical information from endpoint, identity, firewall, email, network, cloud and other security technologies to determine the nature, scope, severity and potential impact of cybersecurity events.

• Coordinates and/or performs incident containment, eradication and recovery activities; documents investigation timelines, evidence, decisions and corrective actions; assists with post-incident reviews and identifies opportunities to improve security controls and response processes.

• Administers, monitors, maintains and continually improves Cabrillo Coastal’s security technology suite, including endpoint security tools, firewalls, identity and access management technologies, multifactor authentication solutions and other cybersecurity platforms.

• Reviews security-platform configurations, policies, alerts, exclusions, integrations, system health and operational effectiveness; recommends and implements configuration changes, process improvements and additional security capabilities, as appropriate.

• Reviews vulnerability scans, penetration-test findings, threat intelligence, security assessments, vendor notifications and technical advisories to identify potential risks to Cabrillo Coastal systems, applications, networks and business operations.

• Evaluates and prioritizes security findings based upon system exposure, exploitability, business criticality, data sensitivity, available safeguards and potential organizational impact.

• Translates cybersecurity findings into clearly defined and actionable tickets or work items for IT, Systems/Development and other responsible teams; identifies affected systems, supporting evidence, recommended corrective actions, priority levels and validation requirements.

• Tracks identified vulnerabilities and security-remediation activities through completion; verifies that corrective actions have been implemented and appropriately address the identified risk.

• Performs proactive security reviews and threat-hunting activities using available endpoint, network, identity, email, firewall and system information to identify potentially malicious or unauthorized activity.

• Contributes to the design, implementation and review of secure systems, networks, applications, cloud services and business processes; participates in technology projects and architecture reviews to identify security requirements and risks.

• Provides technical security guidance regarding system configuration, network segmentation, endpoint protection, application control, identity management, privileged access, multifactor authentication, encryption, logging, monitoring and other cybersecurity safeguards.

• Assists with developing, reviewing and maintaining Company cybersecurity policies, technical standards, operating procedures, incident-response plans, security playbooks and system-hardening requirements.

• Ensures assigned systems, configurations, projects and security practices align with Company policies, approved security standards, regulatory requirements and organizational risk tolerance.

• Supports identity and access-management activities, including least-privilege access, role-based access, privileged-account protection, multifactor authentication, access reviews and investigation of potentially inappropriate or unauthorized access.

• Assists with internal and external audits, cybersecurity assessments, regulatory examinations, cyber-insurance requests and compliance-related activities by gathering technical evidence, documenting security-control operation and responding to technical inquiries.

• Works with technology vendors, consultants, managed security providers and other external partners to investigate cybersecurity events, resolve technical issues and improve the effectiveness of security services.

• Develops and maintains security reports, metrics, dashboards and technical documentation to communicate cybersecurity activity, incidents, vulnerabilities, remediation progress and areas of risk to IT leadership and other stakeholders.

• Identifies recurring alerts, process weaknesses, control gaps and opportunities for automation; recommends and implements practical improvements to strengthen security and increase operational efficiency.

• Creates and maintains security runbooks, investigation procedures, technical diagrams, configuration documentation and other information necessary to support effective and consistent security operations.

• In accordance with Company mission, values and goals, establishes and maintains exceptional, service-oriented working relationships; serves as a positive, professional and knowledgeable Company representative during interactions with employees, vendors, business partners and other external contacts, as applicable.

• Actively contributes as a member of the Cabrillo Coastal Team by providing cybersecurity guidance, technical assistance and support to IT and other Company team members, as directed.

• Dynamically enhances Company success by taking advantage of learning and development opportunities and personally integrating positive actions to improve individual performance, technical capabilities and the Company’s overall cybersecurity posture.

• Participates in, assists with and/or carries out responsibilities for “special” Company projects, cybersecurity initiatives, incident-response exercises and other activities, as directed.

• Provides after-hours support for significant cybersecurity incidents, emergency remediation activities or planned security changes, as necessary.

Requirements

Skills and Expertise

Qualities: security-oriented; quality-oriented; detail-oriented; analytical; self-starter; team player; multi-tasker; adaptable; flexible; dependable; inquisitive; collaborative; service-oriented; coachable; strong work ethic; positive “can do” attitude; sound judgment; discretion; strong sense of ownership and accountability.

Strong skill sets in the following areas: cybersecurity incident investigation and response; technical troubleshooting; problem analysis and solving; risk identification and prioritization; effective decision-making; organization; time management and working under tight deadlines; technical research; documentation; active listening; asking productive questions; applying learned information to a variety of related or similar situations; oral and written communication; interpersonal communication; collaborating with technical and non-technical team members; translating complex technical findings into understandable business risks and actionable technical requirements; reviewing and analyzing endpoint, identity, authentication, firewall, email, network, cloud, application and operating-system logs; independently investigating a technical security finding, identifying potentially affected systems and users, evaluating possible business impact and recommending practical corrective actions; creating clear and complete security-remediation tickets that communicate the affected asset, identified condition, supporting evidence, potential risk, required action, priority and criteria for successful completion; appropriately handling confidential, sensitive and restricted Company information and maintaining discretion during cybersecurity investigations.

Strong working knowledge of: cybersecurity principles and practices, including defense in depth, least privilege, zero-trust concepts, identity security, endpoint security, network security, vulnerability management, system hardening, secure configuration, security monitoring, incident response and risk-based decision-making; cybersecurity threats and attacker techniques, including phishing, credential theft, malicious software, ransomware, social engineering, unauthorized access, privilege escalation, persistence, lateral movement and data exfiltration; Microsoft Windows operating systems, Active Directory, Microsoft Entra ID, Microsoft 365, identity and access-management principles, multifactor authentication and privileged-access controls; endpoint detection and response, antivirus, application control, firewall, vulnerability-management, email-security, identity-security and security-monitoring technologies; networking principles and technologies, including TCP/IP, DNS, DHCP, HTTP/S, VPNs, routing, switching, network segmentation, wireless networking and firewall rules; standard business writing, grammar and punctuation rules; telephone and email business etiquette rules; desktop computer operations; standard business software and web-based operations, including Microsoft Word, Microsoft Excel, Microsoft Outlook, Microsoft PowerPoint, Microsoft Teams and web browsers; familiarity with PowerShell, Python, application programming interfaces or other scripting and automation technologies is a plus; and familiarity with recognized cybersecurity frameworks, standards and regulatory requirements, including the NIST Cybersecurity Framework, CIS Controls, NIST security publications, NYDFS cybersecurity requirements and PCI DSS, is a plus.

Education, Experience, Licenses & Certification 

Education for All levels: Bachelor’s degree in Cybersecurity, IT, Computer Science, or related field or equivalent experience and training.

Experience, LIcenses and Certifications:

IT Security Analyst I: 1–3 years in cybersecurity, IT operations, systems, networking, or related technical support; experience reviewing security alerts, logs, or suspicious activity. Security+ or similar entry-level certification preferred and relevant Microsoft or vendor certifications are a plus.

IT Security Analyst II: 3–5 years of cybersecurity or related infrastructure experience, signficiant experience independently investgating security incidents, hands-on experience with EDR, firewalls, IAM/MFA, vulnerability management, or security monitoring and experience translating security findings into actionable remediation work. CySA+, Microsoft Security, GCIH, CEH, or relevant vendor certifications preferred.

IT Security Analyst III: 5–8+ years of cybersecurity or security engineering experience; experience leading incident investigations and complex remediation efforts; advanced experience managing enterprise security platforms; eExperience with security architecture, vulnerability management, threat hunting, and technical standard; experience mentoring others and serving as a technical escalation point. CISSP, CISM, GIAC, or advanced Microsoft/vendor certifications preferred.