Information Security Analyst II

Responsibilities

• Develops and maintains information security policies, standards, guidelines, and procedures to meet federal, state, and county regulatory requirements.
• Safeguards internal and external audits, assessments, and compliance reviews for security and privacy obligations.
• Manages data preservation and collection requests related to legal matters, VFOIA requests, internal investigations, forensic activities, and other eDiscovery processes.
• Conducts security outreach, delivering awareness training, and assists agencies in interpreting county information security policies.
• Investigates cybersecurity incidents and responds to alerts from SIEM systems, vulnerability scans, endpoint tools, and penetration testing reports.
• Implements, administers, and supports security technologies such as endpoint protection, data loss prevention, intrusion detection/prevention systems, application firewalls, vulnerability management platforms, and forensic utilities used by the ISO.
• Collaborates with DIT divisions, agency information security coordinators, IT analysts, and external partners regarding cybersecurity and compliance matters.
• Serves as a technical and operational advisor on cybersecurity issues, compliance questions, and policy interpretation.
• Stays current with cybersecurity, privacy, and regulatory trends and pursues relevant professional certifications.
• Supports emergency IT events and participates in county Emergency Operations Center activations as needed.

Requirements

• Graduation from an accredited four-year college or university with a bachelor's degree in a computer or information science discipline, IT/cyber security, network or IT systems administration, engineering; or a bachelor's degree in a business or related field that has been supplemented by at least 18 credit hours of intermediate computer science coursework; plus one year of experience in information security systems, network security, or cyber security.
• Experience implementing, assessing, or maintaining compliance with IT and privacy regulations or standards such as HIPAA, PCIDSS, CJIS, Virginia privacy requirements, federal PII protections, and institutional standards such as the NIST Cybersecurity Framework, NIST 80053/171, ISO 27000 series, OWASP, or SANS CIS Controls.
• Experience working with and understanding of security and network architecture, identity and access management, operating systems, cloud services, databases, and modern enterprise technologies.
• Experience with technologies including malware analysis tools, application and network firewalls, VPN solutions, DLP, identity management platforms, SIEM solutions, and intrusion detection/prevention systems.
• Demonstrated experience in policy development, security governance, audit support, and agency consulting.
• Experience applying strong analytical, communication, and collaboration skills in a cybersecurity, compliance, or technical consulting environment.

Physical Requirements

Work is generally sedentary, performed in a normal office environment. All duties performed with or without reasonable accommodations.