Cybersecurity Analyst

Job Details

Position: Cybersecurity Analyst | Duration: 12 months with extension possible | Location: Austin, TX (100% onsite) | Job ID: 529701769 | Agency: HHSC | Anticipated start date: 10/05/2026

Special Requirements: Position is onsite at the location listed above (no remote work). Only local candidates will be considered. Interviews will be conducted through Microsoft Teams.

Level Description

1‑3 years of experience in the field or a related area. Possesses knowledge of commonly used concepts, practices, and procedures within a particular field. Relies on instructions and pre‑established guidelines to perform job functions. Primary job functions do not typically require exercising independent judgment.

Job Summary

The Network Security Analyst I performs advanced cybersecurity analysis and threat‑triage activities within the Cybersecurity Operations Center (CSOC). Work involves continuously monitoring, triaging, analyzing, and prioritizing cybersecurity alerts; investigating suspicious activity; identifying potential threats; and coordinating incident response activities to protect agency information systems, networks, and data. Serves as a primary point of contact for security event analysis, threat identification, and incident escalation.

DISCLAIMER: Candidates for this position will be subject to a pre‑employment security review to determine employment eligibility.

Essential Job Functions

• Monitors, analyzes, and triages cybersecurity alerts generated by SIEM, EDR, cloud security, email security, identity protection, and network security platforms.
• Conducts initial investigations of detected and reported security events to determine severity, scope, impact, and potential risk to agency operations.
• Identifies, validates, and prioritizes potential cybersecurity incidents, escalating confirmed threats to Incident Response, Threat Hunting, or SOC Engineering teams according to established procedures.
• Correlates security events from multiple data sources, including endpoints (EDR), firewalls, IDS, IPS, cloud services, authentication systems, and threat‑intelligence feeds.
• Reviews and analyzes indicators of compromise (IOCs), suspicious network activity, phishing emails, malware detections, and anomalous user behavior.
• Documents investigations, findings, and response actions in ticketing and case‑management systems to ensure accurate tracking and reporting.
• Assists with incident containment, eradication, and recovery efforts by coordinating with technical teams and stakeholders; reports and escalates to the CSOC Team Lead and/or SOC Manager.
• Supports continuous improvement of threat‑detection capabilities through alert tuning, process refinement, threat‑intelligence integration, and identification of false‑positive trends.
• Performs vulnerability‑assessment reviews and evaluates identified vulnerabilities for potential risk and remediation prioritization.
• Supports development and maintenance of operational procedures, playbooks, workflows, and knowledge‑base articles related to threat detection and incident response.
• Researches emerging cyber threats, attack techniques, tactics, and procedures (TTPs) to improve detection and response effectiveness.

Knowledge, Skills, and Abilities

• Cybersecurity Operations Center (CSOC/SOC) operations and best practices.
• Security incident triage, analysis, investigation, and escalation procedures.
• Security monitoring technologies, including SIEM, EDR/XDR, IDS/IPS, firewalls, endpoint security solutions, and cloud security platforms.
• Common cyber threats, attack vectors, malware, phishing campaigns, insider threats, and advanced persistent threat (APT) techniques.
• Threat‑intelligence concepts, indicators of compromise (IOCs), indicators of attack (IOAs), and MITRE ATT&CK methodologies.
• Windows, Linux, networking protocols, Active Directory, Microsoft Entra ID, cloud environments, and enterprise security controls.
• Incident‑response lifecycle and cybersecurity frameworks such as NIST Cybersecurity Framework, NIST Incident Response guidance, and PICERL.
• Security event analysis and threat triage.
• Correlating and interpreting data from multiple cybersecurity tools.
• Investigating suspicious activity and identifying indicators of compromise.
• Using SIEM, EDR/XDR, threat intelligence, vulnerability management, and case‑management platforms.
• Producing clear documentation, incident reports, and technical communications.
• Prioritizing and managing multiple investigations in a fast‑paced operational environment for a large organization.
• Knowledge of query languages such as KQL, Lucene, SPL, ESQL, etc.
• Knowledge of scripting languages such as PowerShell, Python, Bash, etc.
• Analyzing complex security