Cybersecurity Operations Center Analyst

Location: Austin, TX

About the role

This position is open to U.S. Citizens and permanent residents. This onsite role requires the selected candidate to work from an HHS office in Austin, Texas. The Cybersecurity Analyst III performs senior-level cybersecurity operations work with emphasis on threat detection, incident investigation, security monitoring, cyber defense, and operational response activities. The role supports agency on-premises and cloud environments by identifying, analyzing, investigating, and responding to cybersecurity threats impacting agency systems, applications, hosts, networks, cloud services, and data.

The Cybersecurity Operations Center (CSOC) Analyst is responsible for monitoring enterprise security operations and coordinating the detection and response of cybersecurity incidents. This position provides senior-level expertise in threat analysis, incident triage, threat intelligence, security monitoring, and cyber defense operations. The analyst leverages advanced security technologies and investigative methodologies to identify malicious activity, assess risk, and coordinate containment and remediation activities. The CSOC Analyst develops and maintains awareness of the agency's cybersecurity threat landscape, evaluates emerging threats and attack techniques, and supports the implementation of strategies that strengthen the agency's security posture.

This position serves as a critical operational resource in protecting agency systems and data while ensuring that cybersecurity monitoring, detection, and response activities align with agency security objectives, State of Texas requirements, and industry best practices. The Analyst works under limited supervision with considerable latitude for the use of initiative and independent judgment. The Analyst will research and implement new threat detection methodologies, monitoring capabilities, investigative techniques, and response strategies for the prevention, detection, containment, and remediation of cybersecurity incidents. The Analyst provides expert guidance regarding cybersecurity threats, incident response procedures, threat intelligence findings, and emerging risks. This role partners closely with security engineering, vulnerability management, system administration, cloud operations, and application support teams to strengthen organizational cyber resilience.

Responsibilities

• Security Monitoring & Incident Detection - 35%
  • Monitors security events and alerts generated through Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR/XDR), identity security, cloud security, email security, vulnerability management, and network security platforms.
  • Performs initial triage and analysis of cybersecurity alerts to determine severity, scope, impact, and potential organizational risk.
  • Reviews indicators of compromise (IOCs), indicators of attack (IOAs), anomalous user activity, threat intelligence information, phishing campaigns, malware activity, and suspicious network behavior.
  • Correlates events from multiple security technologies to identify attack patterns and potential cybersecurity incidents.
  • Evaluates detection effectiveness and recommends improvements to monitoring capabilities and alert fidelity.
• Incident Response & Investigation - 30%
  • Leads and conducts investigations of cybersecurity events and incidents.
  • Coordinates response activities with Incident Response, Security Engineering, Infrastructure Services, Cloud Operations, and other support teams.
  • Assists with incident containment, eradication, recovery, and post-incident review activities.
  • Documents investigations, findings, recommendations, lessons learned, and response actions.
  • Supports forensic investigations and evidence preservation activities as appropriate.
• Threat Intelligence & Threat Hunting - 15%
  • Researches emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and industry threat trends.
  • Performs threat hunting activities across enterprise systems and cloud environments to identify previously undetected threats.
  • Leverages commercial, industry, government, and open-source threat intelligence to enhance detection and response capabilities.
  • Develops recommendations for improving agency visibility into emerging threats.
• Security Operations Improvement & Collaboration - 10%
  • Supports development and tuning of detection use cases, analytics, dashboards, workflows, reports, and operational procedures.
  • Collaborates with security engineering teams to improve monitoring coverage and telemetry collection.
  • Assists with tabletop exercises, incident simulations, adversary emulation, operational readiness activities, and continuous improvement initiatives.
  • Provides input into cybersecurity strategy and operational enhancements.
• Other Duties - 10%
  • Performs additional cybersecurity operations activities as assigned, including special projects, process improvement initiatives, operational readiness efforts, reporting activities, audit support, and agency cybersecurity initiatives.

Requirements

• Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field is strongly preferred. Education and experience may be substituted for one another on a year-for-year basis.
• At least 5+ years of experience in information technology, cybersecurity, security operations, detection engineering, systems/network administration, or related disciplines.
• Experience working in a Security Operations Center (SOC).

Skills

Knowledge of:

• Security Operations Center methodologies, operations, and best practices.
• Incident response concepts, procedures, and investigation techniques.
• Enterprise cybersecurity technologies including SIEM, EDR/XDR, IDS/IPS, NDR, NGFW, SOAR, cloud security, email security, identity protection, and vulnerability management solutions.
• Threat intelligence frameworks, MITRE ATT&CK, cyber threat actor behaviors, and attack methodologies.
• Operating systems, networking protocols, Active Directory, Microsoft Entra ID, cloud computing platforms, and enterprise security architectures.
• Security and risk management frameworks such as NIST Cybersecurity Framework, NIST 800-61, CIS Controls, and State of Texas cybersecurity requirements (including TAC Chapter 202).

Skill in:

• Written and verbal communication.
• Analyzing and solving complex cybersecurity problems.
• Conducting threat investigations and incident analysis.
• Correlating security data from diverse sources and technologies.
• Identifying risk and recommending appropriate response actions.
• Producing operational reports, technical documentation, and executive summaries.

Ability to:

• Analyze large volumes of security telemetry and rapidly identify threats.
• Make sound decisions during cybersecurity investigations and incident response activities.
• Communicate technical information to both technical and non-technical audiences.
• Work collaboratively with diverse teams and provide operational cybersecurity guidance.
• Manage multiple concurrent investigations and priorities in a fast-paced environment.

Qualifications

• Prefer one or more of the following certifications:
  • Certified Information Systems Security Professional (CISSP)
  • CompTIA CySA+
  • Microsoft Certified: Security Operations Analyst Associate (SC-200)
  • GIAC Certified Incident Handler (GCIH)
  • GIAC Certified Intrusion Analyst (GCIA)
  • GIAC Continuous Monitoring Certification (GMON)
  • Certified SOC Analyst (CSA)

Benefits

The Texas Health and Human Services Commission (HHSC) offers a comprehensive benefits package including:

• 100% paid employee health insurance for full-time eligible employees.
• A defined benefit pension plan.
• Generous time off benefits.
• Numerous opportunities for career advancement.

Explore more details on the Benefits of Working at HHS webpage.

Pay

Salary Range: $7,015.16 - $11,864.50 per month

Schedule

• Full-time
• Day shift (First)
• Onsite in Austin, TX (not eligible for full-time telework)