Cyber Intelligence Center- Cyber Incident Manager

Cyber Intelligence Center- Cyber Incident Manager

Salary

$114,296.00 - $161,512.00 Annually

Location

Throughout San Bernardino County, CA

Job Type

Full-time

Job Number

26-15028-01

Department

Innovation and Technology Department

Opening Date

10/17/2026

Closing Date

10/30/2026 5:00 PM Pacific

FLSA

Non-Exempt

• Description
• Benefits
• Questions

The Job

San Bernardino Countys Innovation and Technology Department (ITD) is seeking qualified and motivated professionals to serve as the Cyber Intelligence Center (CIC)- Cyber Incident Manager (CIM)*. The County's CIC protects and monitors critical government services and systems in a highly regulated environment, residents' data assets, and departmental operations.

In this role, you will oversee countywide cybersecurity events and incidents from initial triage through recovery, lead daily CIC briefings to establish priorities, and coordinate a unified threat-informed response.

The CIC CIM is a subject-matter expert responsible for:

• Managing and leading the County's CIC staff in coordinating analysis, responses (e.g., Threat Modeling), containment/eradication, recovery, and post-incident activities of cybersecurity incidents.
• Knowledgeable in the selection and application of various threat models.
• Coordinating activities across the County with affected departments' leadership and technical teams, legal and privacy personnel, external partners, etc.
• Overseeing the incident lifecycle, including detection, analysis, containment, evidence preservation, eradication, recovery, and post-incident improvements in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-61r3 and NIST Cybersecurity Framework 2.0.
• Monitoring incident response activities and service-level agreements with the County's Managed Detection and Response (MDR) Services partner.
• Administer, support, and formulate relevant County / ITD policies, standard practices, and procedures.
• Lead, develop, and administer table-top exercises throughout the County / ITD as required.
• Provide presentations, briefings, etc. as required to County and departmental leadership.
• Ability to translate technical cyber information into layman's terms for briefings, after-action reports, etc.
• Ability to identify, quantify, and maintain relevant incident response matrices, tracking Mean-Time-To-Respond (MTTR), etc.
• Manage the County's Security Information and Event Management (SIEM) environment that includes but not limited to the architecture, connectors, analytics, watchlists, workbooks, etc.
• Develop SIEM automation rules and logic app playbooks to codify containment and enrichment, integrating identity, endpoint, email, and network actions while preserving forensic evidence.
• Promoting ITD security cultural norms, including outcome-based execution, fact-based problem-solving, a sense of urgency, and collaboration.
• Managing, leading, and developing Information Security Analysts and other CIC team members.

Official job title: Information Security Analyst III; for detail refer to the Information Security Analyst III job description.

ABOUT THE DEPARTMENT

The Innovation and Technology Department is San Bernardino County's primary technology service provider entrusted with managing and safeguarding the County's enterprise mission critical systems and infrastructure. It is our goal to empower the County through innovation and enterprise solutions that promote progress through technology and provide transparency and mobility that enable staff to focus on addressing and resolving issues toward the progress of the County's mission, ensuring continued success. Learn more about our initiatives in ITs Strategic Plan.

EXCELLENT BENEFITS

To review job specific benefits, refer to: Summary of Benefits and the Memoranda of Understanding (MOU).

CONDITIONS OF EMPLOYMENT

Pre-Employment Process: Selected candidates must successfully pass a background check and a job-related physical exam, including a drug test, prior to employment.

Availability: Incumbents may occasionally work evening and weekend hours. Some overtime, on-call, or call back work may be required.

Sponsorship: San Bernardino County is unable to consider candidates who require visa sponsorship at this time or in the future. Candidates must be able to present their legal right to work in the United States.

Minimum Requirements

Qualifying candidates must meet the requirements in ALL of the following categories:

EXPERIENCE:

Five (5) years of full-time equivalent experience assisting with the implementation, management, and monitoring of IT security solutions and programs.

LEADERSHIP:

Three (3) years of full-time experience leading a Security Operations Center (SOC) in a medium-to-large enterprise, including incident triage and escalation, SIEM oversight (e.g., Microsoft Sentinel), and coordination across identity, endpoint, email, and network security teams. Experience may be concurrent.

EDUCATION:

Sixty (60) semester (90 quarter) units of completed courses from an accredited college or university in information technology, computer science, software engineering/programming, or a related field.

SUBSTITUTION: One (1) additional year of qualifying work experience may substitute for the education requirement.

Qualifying degrees and coursework must be conferred by institutions accredited by an accrediting body recognized by the U.S. Department of Education. Degrees earned outside the United States must be accompanied by an evaluation from a recognized credential evaluation service verifying U.S. equivalency.

Desired Qualifications

The ideal candidate will possess:

• A bachelor's degree in information security, computer science, business administration, public administration, or a related field, or equivalent experience
• Microsoft security stack (e.g., Defender, Sentinel, Entra ID), SIEM/EDR, and KQL-based analytics
• Excellence in executive and stakeholder communication; ability to produce briefings and after-action reports/reviews to formulate corrective actions plan.
• Ability to integrate external intelligence from but not limited to MS-ISAC, CISA, and CAL-CSIC, enrich indicators, and verify enforcement across County controls
• Must demonstrate strong, steady leadership in a high-stress, time-compressed environment, making clear decisions, communicating calmly, and guiding cross-functional teams to execute incident actions with urgency and discipline.

Selection Process

Examination Procedure:

There will be a competitive evaluation of qualifications based on the information provided in the Application and the Supplemental Questionnaire. You are encouraged to include detailed descriptions of your qualifying experience and skills, as only the most highly qualified applicants will be referred to the Department.

Application Procedure:

Please complete and submit the online employment application and supplemental questionnaire for consideration before 5:00 PM PST, FRIDAY, OCTOBER 30, 2026. Resumes will not be accepted in lieu of the application and/or supplemental questionnaires.

To ensure timely and successful submission of your online application, please allow ample time to complete and submit your application before the filing deadline. Applicants will be automatically logged-out if they have not submitted the application and all required materials prior to the posted deadline. Once your application has been successfully submitted you will receive an onscreen confirmation and an email. We recommend that you save and/or print these for your records. Please note: if you do not receive an onscreen confirmation and an email acknowledging our receipt of your application, we have not received your application.

If you need technical assistance, follow this link to review the Government Jobs online application guide or contact their Toll-Free Applicant Support line at (855) 524-5627. Please note that Human Resources is not responsible for any issues or delays caused by your internet connection, computer, or browser when submitting an application.

Equal Employment Opportunity (EEO) / Americans with Disabilities Act (ADA):

San Bernardino County is an Equal Employment Opportunity (EEO) and Americans with Disabilities Act (ADA) compliant employer, dedicated to ensuring equal employment opportunities for all employees and applicants.

ADA Accommodation:

If you have a disability and need accommodations during the testing process, please submit the Special Testing Accommodations Request Form (Download PDF) within one week of the recruitment filing deadline.

Veterans Preference:

Eligible veterans, their spouses, or widows/widowers who are not current County employees may receive additional Veterans Preference points. For details and instructions on how to request these points, please refer to the Veterans Preference Policy.

For more important details, review the Applicant Information and County Employment Process.

Supervisory Unit

San Bernardino County offers a range of benefit programs for employees and their eligible dependents. These include health, dental, vision, and life insurance, as well as a variety of other voluntary benefits. Programs and benefit amounts vary and are based on bargaining unit, family size, hire date, plan selection, and number of hours worked.

Please review the appropriate Summary of Benefits* for more information

Refer to the appropriate MOU, contact the County's Employee Benefits and Services Division at (909) 387-5787 or visit the Employee Benefits website for more detailed information.

• Retirement benefits subject to change.

01

PLEASE READ THE BELOW STATEMENT

Instructions: The information provided on your application and in your responses to the following Supplemental Questionnaire will be used to determine if you meet the minimum requirements for this position. It is in your best interest to be as thorough as possible in your responses. Resumes will NOT be reviewed to determine qualifications. Applicants will not be able to update their application materials or answers to the questionnaire once the application has been submitted. Failure to submit all requested information may result in disqualification or adversely affect the evaluation of your application. Note: Experience listed on this questionnaire must also be listed and fully detailed in the work experience section of your application.

• I have read and understand the above statement.

02

Education/Coursework: Please provide your completed education information. Please note, failure to provide the required education information can adversely affect the evaluation of your application.

COURSEWORK: If listing coursework, include the school name, class title, number of units, and type of units (semester/quarter). Unofficial transcripts may be attached in lieu of listing coursework. Example: CSUSB, Intro to Computer Science, 3 semester.

DEGREE: If you possess a degree from an accredited college or university, include the school name, type of degree, and major. Example: CSUSB, Bachelor of Science, Computer Science

If no education, indicate "N/A."

03

Security Operations Center Experience: Describe your experience and competency level (i.e., expert, moderate, novice, or knowledge only) assisting with the implementation, leading, management, and monitoring and analysis of IT cybersecurity incidents and events, solutions threat intelligence analysis and investigation, penetration testing, vulnerability scanning, and use of other related computer forensic tools and programs. In your response, be sure to include the name of your employer, your job title, and other relevant duties. Experience listed must be listed and fully detailed in the work experience section of your application. If no experience, indicate "N/A"

04

Security Awareness Training Program and Policy Formulation Experience: Describe your experience and competency level (i.e., expert, moderate, novice, or knowledge only) establishing, supporting, and innovating your organizations security awareness training program that includes phishing simulation exercises. Specific to this program, describe in detail at least two (2) accomplishments that demonstrate cybersecurity risk was mitigated. Describe your experience by citing at least two (2) examples of your work in formulating a policy, standard, or process/procedure associated with an organizations information security program. In your response, include the name of the employer, your job titles and other relevant experience. Experience must be listed and fully detailed in the work experience section of your application. If no experience, indicate "N/A."

05

Incident Response Management Experience: Describe your experience and competency level (i.e., expert, moderate, novice, or knowledge only) assisting or leading a cyber or information security event, incident, or breach. Describe in detail at least two (2) notable cybersecurity network intrusions/incidents where you were the primary or lead individual and share your experience and approach, methodology, actions taken, preventive measures suggested/recommended, and your interaction with law enforcement (if applicable). In your response include name of employer, date (month and year) of the intrusion/incident, without providing any sensitive information specific to these two intrusions/incidents. If no experience, indicate N/A.

06

Applicant Acknowledgement - Notification via email: As part of our efforts to increase efficiency and promote conservation of resources, human resources uses email to communicate with applicants. Therefore, all future communications regarding this recruitment, including applicant status and testing notifications, will be made via email. Each applicant needs their own email address. We strongly encourage you, as an applicant, to ensure that the email address you have provided us with your application is current, secure, confidential, and readily accessible to you. Adjust Spam and/or other filters so that our emails are accepted. Please carefully read any notices that we send you and follow any instructions provided in a timely manner. We will not be responsible in any way if you do not receive our emails (i.e., for the non-delivery of our emails or if you fail to check your e-mail on a timely basis).

• I acknowledge that I have read, understood, and agree to the above.

07

ATTENTION GMAIL USERS

We have become aware of an increase in Gmails spam filter sensitivity. Due to this change, it is possible that emails coming from San Bernardino County Human Resources may be marked as spam and will not make it into your Gmail inbox.

For your convenience, a step-by-step guide to create and apply filters within Gmail is available in the attached PDF. Download the PDF Guide. Once downloaded, follow the instructions so that you will receive future emails from San Bernardino County Human Resources.

Note: If you apply the filters and still do not receive emails from San Bernardino County Human Resources you can check your www.governmentjobs.com (Neogov) account inbox. All notifications will appear there.

• I understand

08

Applicant Acknowledgement - Application Complete: Thank you for taking the time to complete this application and supplemental questionnaire. Please be sure to review all information provided prior to submitting it as you cannot update or revise it once submitted. Your submitted application will be reviewed and evaluated as is. Please do not refer to a resume or other documentation in lieu of completing the employment history section or responding to the supplemental questions; they will not be reviewed or considered.

Once your application has been successfully submitted, you will receive an onscreen confirmation and an email confirmation will be sent to the email address listed on your application. We recommend that you save and/or print these for your records. Please note: if you do not receive an onscreen confirmation and an email acknowledging our receipt of your application, we have not received your application.

• I acknowledge that I have reviewed my application and understand that I will not be able to update or revise any part of it once submitted.

Required Question

Employer San Bernardino County

Address 175 West Fifth Street, 1st Floor

San Bernardino, California, 92415-0440

Phone (909) 387-8304

TTY Users: 711

Website http://www.sbcounty.gov/jobs