Job Posting:

TBD

Opened:

TBD

Closes:

TBD

Position Title:

Cybersecurity Analyst III (Cloud Security Assessor)

Class/Group:

0324/B29

Military Occupation Specialty Code:

Army-17C, 25B; Navy-IT, 682X; Coast Guard-IT; Marine Corps-0631, 0679, 0681, 8055; Air Force-3D0X3

FLSA:

Exempt

Number of Vacancies:

1

Division/Section:

Office of the Chief Information Security Officer / Policy and Governance

Salary Range:

$7699.16 - $9666.67/monthly

Duration:

Regular

Hours Worked Weekly:

40

Work Schedule:

This position may be eligible for flexible work hours and/or a hybrid work schedule if certain program guidelines are met; working arrangements may change at any time at the sole discretion of the agency.

Travel:

Occasional

Agency Address:

300 W. 15th, Austin, Texas 78701

Web site:

www.dir.texas.gov

Refer Inquiries to:

Human Resources

Telephone:

(512) 463-5920 or (512) 475-4612

HOW TO APPLY:

• Select “Apply Online” to apply for the job at https://capps.taleo.net/careersection/ex/jobsearch.ftl?lang=en

• You must create a CAPPS Career Section candidate profile or be logged in to apply

• Update your profile and apply for the job by navigating through the pages and steps

• Once ready, select “Submit” on the “Review and Submit” page

• If you have problems accessing the CAPPS Career Section, please email the CAPPS Recruiting Help Desk at capps.recruiting@cpa.texas.gov

SPECIAL INSTRUCTIONS:

• Applicants must provide in-depth information in the EXPERIENCE & CREDENTIALS section to demonstrate how they meet the position qualifications. Incomplete applications may result in disqualification.

• Resumes may be uploaded as an attachment but are not accepted in lieu of the information required in the EXPERIENCE & CREDENTIALS section of the application.

Interview Place/Time:

Candidates will be notified of appointments as determined by the selection committee.

Notice:

Section 651.005 of the Government Code requires males, ages 18 through 25 years, to provide proof of their Selective Service registration or proof of their exemption from the requirement as a condition of state employment.

EQUAL OPPORTUNITY EMPLOYER

The Department of Information Resources does not exclude anyone from consideration for recruitment, selection, appointment, training, promotion, retention, or any other personnel action, or deny any benefits or participation in programs or activities, which it sponsors on the grounds of race, color, national origin, sex, religion, age, or disability. Please call 512-463-5920 to request reasonable accommodations.

THE OPPORTUNITY

The Texas Department of Information Resources is the state agency charged with protecting the state’s data and critical technology infrastructure, managing a multi-million-dollar cooperative contracts program, and providing strategic technology leadership, solutions, and innovation to all levels of the Texas government. DIR is a fast-paced and collaborative environment with highly motivated and engaged employees dedicated to achieving the best value for the state.

The person in this role performs highly advanced (senior-level) information security analysis functions that include planning, implementing, and monitoring security program elements and services that support government organizations throughout the state of Texas in the protection of information resources. Will be responsible for assisting in the development and implementation of the state’s Risk Authorization and Management Program. Will assist with the statewide information security governance, risk, and compliance program development and operations. Will interact frequently with cloud service providers, and agency personnel using a variety of communication mechanisms to convey service delivery information and program implementation details with the purpose of engaging organizations with the statewide security program. This person in this role may also assist in the delivery of incident response services, preparedness, and program delivery of the Cyber Incident Response Team. Works under minimal supervision, with considerable to extensive latitude for the use of initiative and independent judgment. May, at times, assign and/or oversee the work of others.

WHAT WE DO

The ideal candidate will have the ability to highlight their strengths in the following functions:

• Assists with administration and operations of the Texas Risk and Authorization Management Program (TX-RAMP) for state agencies and institutions of higher education and serves as the subject matter expert in certifying cloud vendors under the TX-RAMP program. Assessing the security posture of cloud environments, including infrastructure, applications, and services, to identify vulnerabilities and risks.
• Providing technical guidance and expertise to internal and external stakeholders on cloud security, risk management, and compliance.
• Preparing detailed assessment reports with findings, recommendations, and remediation plans to address identified vulnerabilities and risks.
• Researches and evaluates new and emerging GRC services; Supports efforts, as part of the GRC development and support team responsible for design, development, and implementation of new processes, applications, and reporting using the DIR GRC system.
• Supports the statewide GRC portal (Archer) on information security matters including policy and compliance management, risk management, incident management and data breach reporting within the enterprise governance, risk, and compliance framework.
• Assists in the development and implementation of enterprise security strategies, policies, and plans, as well as the formulation and dissemination of standards and guidelines to manage statewide information and information asset related risks, threats, and vulnerabilities.
• Analyzes statewide security data and assists in the preparation of presentations and reports in support of the statewide security program to be delivered to DIR Executive Management and Board of Directors, customers, and the state leadership.

OTHER DUTIES

• As needed, deliver direct incident response support to mitigate the impacts of and support impacted organizations transition to recovery during cybersecurity incidents in the state.
• Performs other related as assigned.

EDUCATION

• Graduation from an accredited four-year college or university with major coursework in Business, MIS, Computer Science, Information Security, or a related field.
• Additional work-related experience may be substituted for education on a year-for-year basis. (High School diploma or equivalent certificate required.)

EXPERIENCE & TRAINING REQUIRED

• Five (5) years of progressively responsible experience in the IT industry
• Five (5) years of experience developing and implementing security program functions into a risk-based security program with the ability to demonstrate in-depth knowledge of policy development, risk evaluation, and cost-benefit analysis to support security program decisions.
• Three (3) years of experience conducting third-party/cloud security assessments.

EXPERIENCE & TRAINING PREFERRED

• Project management experience in an information technology environment
• Experience with State of Texas information security requirements including Texas Administrative Code §202
• Experience with Federal Information Security Management Act (FISMA) and National Institute of Standards (NIST) 800 Series Special Publications or other security standards and regulations.
• Experience collaborating with outsourced IT service delivery organizations
• One of the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Information Systems Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Cloud Security Professional (CCSP) or other relevant industry standard information security certifications
• Experience in using or developing governance, risk, and compliance software and platforms
• Experience with Archer Integrated Risk Management software
• Experience with Data Visualization/Reporting software
• Experience conducting IT Security Audits and Risk Assessments
• Experience and familiarity with FedRAMP or StateRAMP

KNOWLEDGE, SKILLS & ABILITIES

• Knowledge of data communications, networking, computer programming and systems analysis
• Knowledge of information security operations and services processes
• Knowledge of principles, practices, and techniques of management controls and information security protections as applied to state government
• Knowledge of Texas State government and related information technology processes
• Knowledge of security metrics, benchmarking activities and expectations, and security operational monitoring processes
• Knowledge of cloud computing architecture and cloud security best practices
• Ability to handle multiple projects and initiatives
• Ability to prepare technical issues papers and research reports, and effectively deliver oral presentations and written reports to IT and non-IT management
• Ability to advise technical staff from customer agencies
• Ability to establish and maintain effective and cordial working relationships at all organizational levels, including agency management, direct supervisors, co-workers, internal and external customers
• Ability to understand, follow and convey brief oral and/or written instructions
• Ability to communicate both verbally and in writing, in a clear and concise manner
• Ability to work independently and as part of a team, and to support and contribute to a cohesive team environment
• Ability to work under pressure and exacting schedules to complete assigned tasks
• Ability to work a flexible schedule to meet required deadlines
• Ability to travel as necessary to support agency requirements
• Ability to comply with all agency policy and applicable laws
• Ability to comply with all applicable safety rules, regulations, and standards

COMPUTER SKILLS

• Proficiency in the use of a personal computer and applicable software necessary to perform work assignments e.g., word processing, Visio (or similar), spreadsheets (Microsoft Office preferred), and project management tools (Microsoft Project preferred).

OTHER REQUIREMENTS

• If notified outside of normal working hours of a potential incident the person in this role will be expected to perform the duties of the position to the extent required to respond to the Cyber Incident.
• Regular and punctual attendance
• Criminal background check

WORK ENVIRONMENT

• Frequent use of a personal computer, copiers, printers, and telephones
• Frequent work under stress, as a team member, and in direct contact with others
• Frequent standing, walking, sitting, listening, and talking
• Occasional bending, stooping, lifting, and climbing