Cybersecurity Analyst I/II/III

Our Cybersecurity Analyst is a hands-on cybersecurity professional who is dedicated to maintaining the confidentiality, integrity and availability of Cabrillo Coastal’s information systems and data and helps protect the Company’s systems, networks, applications, data and users from cybersecurity threats. This position provides broad technical security support across the organization by investigating security incidents, administering cybersecurity technologies, identifying and evaluating risks and partnering with other technology teams to implement effective safeguards and corrective actions.

In the spirit of our Company’s mission, values and culture, the duties listed below serve as illustrations of the various types of work that may be performed by our Cybersecurity Analysts I/II/III. We also expect our Cybersecurity Analysts I/II/III to carry out other responsibilities that are similar, related or a logical assignment to this job class.

• Leads and/or performs investigations of suspected cybersecurity incidents, including phishing, compromised accounts, malicious software, ransomware, unauthorized access, suspicious endpoint activity, data exposure and other potential security events.

• Reviews, analyzes and correlates alerts and technical information from endpoint, identity, firewall, email, network, cloud and other security technologies to determine the nature, scope, severity and potential impact of cybersecurity events.

• Coordinates and/or performs incident containment, eradication and recovery activities; documents investigation timelines, evidence, decisions and corrective actions; assists with post-incident reviews and identifies opportunities to improve security controls and response processes.

• Administers, monitors, maintains and continually improves Cabrillo Coastal’s security technology suite, including endpoint security tools, firewalls, identity and access management technologies, multifactor authentication solutions and other cybersecurity platforms.

• Reviews security-platform configurations, policies, alerts, exclusions, integrations, system health and operational effectiveness; recommends and implements configuration changes, process improvements and additional security capabilities, as appropriate.

• Reviews vulnerability scans, penetration-test findings, threat intelligence, security assessments, vendor notifications and technical advisories to identify potential risks to Cabrillo Coastal systems, applications, networks and business operations.

• Evaluates and prioritizes security findings based upon system exposure, exploitability, business criticality, data sensitivity, available safeguards and potential organizational impact.

• Translates cybersecurity findings into clearly defined and actionable tickets or work items for IT, Systems/Development and other responsible teams; identifies affected systems, supporting evidence, recommended corrective actions, priority levels and validation requirements.

• Tracks identified vulnerabilities and security-remediation activities through completion; verifies that corrective actions have been implemented and appropriately address the identified risk.

• Performs proactive security reviews and threat-hunting activities using available endpoint, network, identity, email, firewall and system information to identify potentially malicious or unauthorized activity.

• Contributes to the design, implementation and review of secure systems, networks, applications, cloud services and business processes; participates in technology projects and architecture reviews to identify security requirements and risks.

• Provides technical security guidance regarding system configuration, network segmentation, endpoint protection, application control, identity management, privileged access, multifactor authentication, encryption, logging, monitoring and other cybersecurity safeguards.

• Assists with developing, reviewing and maintaining Company cybersecurity policies, technical standards, operating procedures, incident-response plans, security playbooks and system-hardening requirements.

• Ensures assigned systems, configurations, projects and security practices align with Company policies, approved security standards, regulatory requirements and organizational risk tolerance.

• Supports identity and access-management activities, including least-privilege access, role-based access, privileged-account protection, multifactor authentication, access reviews and investigation of potentially inappropriate or unauthorized access.

• Assists with internal and external audits, cybersecurity assessments, regulatory examinations, cyber-insurance requests and compliance-related activities by gathering technical evidence, documenting security-control operation and responding to technical inquiries.

• Works with technology vendors, consultants, managed security providers and other external partners to investigate cybersecurity events, resolve technical issues and improve the effectiveness of security services.

• Develops and maintains security reports, metrics, dashboards and technical documentation to communicate cybersecurity activity, incidents, vulnerabilities, remediation progress and areas of risk to IT leadership and other stakeholders.

• Identifies recurring alerts, process weaknesses, control gaps and opportunities for automation; recommends and implements practical improvements to strengthen security and increase operational efficiency.

• Creates and maintains security runbooks, investigation procedures, technical diagrams, configuration documentation and other information necessary to support effective and consistent security operations.

• In accordance with Company mission, values and goals, establishes and maintains exceptional, service-oriented working relationships; serves as a positive, professional and knowledgeable Company representative during interactions with employees, vendors, business partners and other external contacts, as applicable.

• Actively contributes as a member of the Cabrillo Coastal Team by providing cybersecurity guidance, technical assistance and support to IT and other Company team members, as directed.

• Dynamically enhances Company success by taking advantage of learning and development opportunities and personally integrating positive actions to improve individual performance, technical capabilities and the Company’s overall cybersecurity posture.

• Participates in, assists with and/or carries out responsibilities for “special” Company projects, cybersecurity initiatives, incident-response exercises and other activities, as directed.

• Provides after-hours support for significant cybersecurity incidents, emergency remediation activities or planned security changes, as necessary.