Cybersecurity Operations Center Engineer

We need to output HTML fragment with sections: About the role? The posting includes description. We need to include sections only if real content. Likely sections: About the role (maybe from description), Responsibilities (Essential Job Functions), Requirements (Knowledge, Skills, Abilities, Registrations, Licensure, Certifications, Initial Screening Criteria), Benefits (they mention benefits package), Pay (Salary Range, Pay Frequency), Schedule (Shift, Additional Shift, Telework Travel, Full Time/Part Time). Also maybe Qualifications? But we can combine. We must not repeat job title as heading. Use

for each section heading. We must preserve all substantive info, not invent. Remove boilerplate: date, location? Actually location is substantive? It says Location: AUSTIN, TX. Could be included maybe in About the role? But location is metadata; we can fold minor metadata into short

or drop. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." So location maybe minor metadata; we can include in a short

after heading? But they said we can fold minor metadata into a short

or drop it. Probably we can include location in a

under About the role. We must not include cookie/navigation/legal/EEO etc. Remove duplicated lines. We need to output only HTML fragment, no /, no markdown fences. Let's extract content: - About the role: "Join the Texas Health and Human Services Commission (HHSC) and be part of a team committed to creating a positive impact in the lives of fellow Texans. At HHSC, your contributions matter, and we support you at each stage of your life and work journey. Our comprehensive benefits package includes 100% paid employee health insurance for full-time eligible employees, a defined benefit pension plan, generous time off benefits, numerous opportunities for career advancement and more. Explore more details on the Benefits of Working at HHS webpage." But benefits also separate. - Functional Title: Cybersecurity Operations Center Engineer - Job Title: Cybersecurity Analyst III - Agency: Health & Human Services Comm - Department: CISO - DSHS 4.2.5 - Posting Number: 20366 - Closing Date: 10/19/2026 - Posting Audience: Internal and External - Occupational Category: Computer and Mathematical - Salary Range: $7,015.16 - $11,864.50 - Pay Frequency: Monthly - Salary Group: TEXAS-B-27 - Shift: Day - Additional Shift: Days (First) - Telework Travel: Regular/Temporary: Regular - Full Time/Part Time: Full time - FLSA Exempt/Non-Exempt: Exempt - Facility Location: Job Location City: AUSTIN - Job Location Address: 701 W 51ST ST - Other Locations: MOS Codes: ... (list) - Brief Job Description: includes citizenship requirement, onsite role, description. - Essential Job Functions (EJFs) with percentages. - Knowledge Of KSAs (list) - Skill In (list) - Ability To (list) - Registrations, Licensure Requirements, Or Certifications: list of preferred certifications. - Initial Screening Criteria: education and experience. - Additional Information: contingent on budget, salary determined per HHSC HR Manual, must be legally authorized to work in US without sponsorship, willing to commute, review Tips for Success. - Military info (maybe not needed). - ADA Accommodations (maybe boilerplate? It's about accommodation; could be considered substantive? Might be considered boilerplate but it's about policy; but we can keep? The instruction says remove EEO/equal-opportunity/scam-warning boilerplate. ADA accommodation maybe similar; but it's not EEO; it's about accommodation. Might keep? Safer to drop as boilerplate? It's not EEO but still a policy statement. Might be considered boilerplate. I'd drop. - Pre-Employment Checks And Work Eligibility: background checks, E-Verify, must bri... truncated. Might be boilerplate; drop. We need to preserve substantive info: benefits, salary, shift, etc. Let's craft sections:

About the role

Join the Texas Health and Human Services Commission (HHSC) and be part of a team committed to creating a positive impact in the lives of fellow Texans. At HHSC, your contributions matter, and we support you at each stage of your life and work journey. This onsite role requires the selected candidate to work from an HHS office in Austin, Texas. The Cybersecurity Analyst III performs senior-level cybersecurity engineering work with emphasis on security operations engineering, security platform administration, detection engineering, automation, orchestration, and cybersecurity infrastructure integration. The role supports agency on-premises and cloud environments by designing, implementing, maintaining, and enhancing security technologies used to protect agency systems, applications, hosts, networks, cloud services, and data. The Cybersecurity Analyst III also participates in incident response as needed. The Cybersecurity Operations Center (CSOC) Engineer is responsible for engineering and maintaining the technical capabilities that enable enterprise security monitoring, threat detection, incident response, threat hunting, and cybersecurity operations. This position provides senior-level expertise in SIEM engineering, security orchestration and automation, cloud security integrations, endpoint security platforms, security monitoring architecture, and detection development. The CSOC Engineer develops and maintains enterprise security monitoring infrastructure, enhances agency cybersecurity visibility, and implements technical solutions that improve the efficiency and effectiveness of security operations. This position serves as a critical technical resource responsible for ensuring security platforms generate reliable, actionable, and meaningful intelligence for cybersecurity analysts, engineers, and leadership. This position performs highly complex information security and cybersecurity engineering work. The Engineer works under limited supervision with considerable latitude for the use of initiative and independent judgment. The Engineer will research, evaluate, implement, and optimize new security technologies, detection methodologies, automation capabilities, integrations, and operational solutions used to prevent, detect, contain, and respond to cybersecurity threats. The Engineer provides expert guidance regarding cybersecurity technologies, monitoring architectures, logging standards, data onboarding strategies, security automation opportunities, and defensive engineering practices. This role partners closely with Cybersecurity Operations, Threat Hunting, Incident Response, Security Architecture, Infrastructure Services, Cloud Operations, and Application Development teams to strengthen the agency's cybersecurity posture. The Engineer also serves as a member of the Incident Response team.

That covers description. Now Responsibilities: Use Essential Job Functions (EJFs) with percentages. We can list as

• each bullet with percentage maybe. Responsibilities: - Attends work on a regular and predictable schedule following agency leave policy and performs other duties as assigned. - Security Operations Engineering & Platform Administration - 35%: Administers, maintains, and optimizes enterprise cybersecurity technologies supporting security monitoring and incident response operations. Designs, implements, and supports SIEM, EDR/XDR, SOAR, threat intelligence, identity protection, cloud security, email security, network security, and vulnerability management platforms. Manages platform configurations, data ingestion pipelines, integrations, scalability, availability, and operational health. Develops and maintains logging standards, monitoring requirements, and telemetry collection strategies across enterprise environments. Performs platform upgrades, configuration management, tuning activities, and technology lifecycle maintenance. - Detection Engineering & Security Automation - 25%: Designs, develops, and maintains security detections, correlation searches, behavioral analytics, dashboards, reports, and threat-hunting content. Develops automation workflows and orchestration solutions to improve operational efficiency and response capabilities. Creates use cases aligned to MITRE ATT&CK techniques, threat intelligence, and agency risk priorities. Enhances alert quality through tuning, enrichment, suppression logic, and continuous improvement efforts. Develops and maintains detection-as-code and content management processes where applicable. Applies knowledge of scripting to automate repeatable tasks. - Security Integration & Data Engineering - 20%: Integrates enterprise security technologies and data sources into cybersecurity monitoring platforms. Collaborates with infrastructure, cloud, identity, networking, and application teams to onboard new systems and services into enterprise monitoring capabilities. Develops data normalization, enrichment, correlation, and operational reporting solutions. Ensures security event visibility across cloud, endpoint, network, application, middleware, database, and authentication systems. Identifies gaps in telemetry coverage and develops solutions to improve security visibility. - Engineering Strategy & Collaboration - 10%: Evaluates emerging security technologies and monitoring solutions to improve agency cybersecurity operations capabilities. Participates in architecture reviews, project consultations, and cybersecurity planning efforts. Supports incident response activities by providing subject matter expertise regarding security technologies and platform capabilities. Provides technical guidance and mentorship to analysts, engineers, and project teams. - Other Duties - 10%: Performs additional cybersecurity engineering activities as assigned, including special projects, proof-of-concept evaluations, process improvements, operational readiness initiatives, audit support, and agency cybersecurity modernization efforts. Now Requirements: combine Knowledge, Skills, Abilities; Registrations, Licensure, Certifications; Initial Screening Criteria. We can have a section "Requirements" with sub-sections? But we must use

  for section headings only; we can have multiple

  sections. So we can have separate sections: Knowledge, Skills, and Abilities; Skill In; Ability To; Certifications; Education and Experience. But maybe better to combine into one Requirements section with lists. But instruction: "Prefer a few substantive sections over many thin ones." So maybe combine into one Requirements section with multiple

  lists. Let's create:

  Requirements

  Knowledge, Skills, and Abilities (KSAs):

  • Security Operations Center architecture, processes, and cybersecurity monitoring methodologies.
  • SIEM, SOAR, EDR/XDR, NDR, IPS/IDS, NGFW, threat intelligence, cloud security, identity security, and vulnerability management technologies.
  • Enterprise logging, event collection, correlation, and security analytics principles.
  • Automation technologies, scripting methodologies, APIs, and systems integration practices.
  • Cloud computing architectures, identity and access management, networking, operating systems, and enterprise security controls.
  • MITRE ATT&CK framework, cybersecurity threat landscapes, adversary behaviors, and defensive engineering concepts.
  • Security frameworks and standards including NIST Cybersecurity Framework, NIST 800-53, CIS Controls, and State of Texas cybersecurity requirements (including TAC Chapter 202).

  Skill In:

  • Security platform administration and configuration.
  • Detection engineering and security content development.
  • Scripting, automation, and systems integration.
  • Data analysis, event correlation, and security analytics.
  • Troubleshooting complex cybersecurity technologies and integrations.
  • Writing technical documentation, engineering procedures, and operational standards.
  • Evaluating cybersecurity technologies and developing technical recommendations.

  Ability To:

  • Design, implement, and maintain enterprise cybersecurity monitoring capabilities.
  • Process large security data sets to support incident response and SOC operations.
  • Analyze complex technical environments and identify engineering improvements.
  • Develop scalable and maintainable security engineering solutions.
  • Communicate technical information to both technical and non-technical audiences.
  • Work collaboratively across multiple teams and disciplines.
  • Manage multiple projects, priorities, and engineering initiatives simultaneously.

  Preferred Certifications: One or more of the following: Certified Information Systems Security Professional (CISSP); Microsoft Certified: Security Operations Analyst Associate (SC-200); GIAC Continuous Monitoring Certification (GMON); GIAC Certified Detection Analyst (GCDA); GIAC Certified Enterprise Defender (GCED