Cybersecurity Operations Center Analyst

Join the Texas Health and Human Services Commission (HHSC) and be part of a team committed to creating a positive impact in the lives of fellow Texans. At HHSC, your contributions matter, and we support you at each stage of your life and work journey. Our comprehensive benefits package includes 100% paid employee health insurance for full-time eligible employees, a defined benefit pension plan, generous time off benefits, numerous opportunities for career advancement and more. Explore more details on the Benefits of Working at HHS webpage.

Functional Title: Cybersecurity Operations Center Analyst

Job Title: Cybersecurity Analyst III

Agency: Health & Human Services Comm

Department: CHIEF INFO SECURITY OFFICE

Posting Number: 20371

Closing Date: 10/20/2026

Posting Audience: Internal and External

Occupational Category: Computer and Mathematical

Salary Range: $7,015.16 - $11,864.50

Pay Frequency: Monthly

Salary Group: TEXAS-B-27

Shift: Day

Additional Shift: Days (First)

Telework:

Travel:

Regular/Temporary: Regular

Full Time/Part Time: Full time

FLSA Exempt/Non-Exempt: Exempt

Facility Location:

Job Location City: AUSTIN

Job Location Address: 701 W 51ST ST

Other Locations:

MOS Codes: 0605,0630,0631,0639,0670,0679,0681,1702,1705,1710,1720,1721,1799,2611,2659,8055,8858,14N,14NX,170A

170B,17A,17B,17C,17C0,17DX,17S,17SX,17X,181X,182X,183X,184X,1B4X1,1D7X1,1N4X1,255A,255N,255S,25B,25D

26A,26B,26Z,514A,5C0X1D,5C0X1N,5C0X1R,5C0X1S,5IX,681X,682X,683X,781X,782X,783X,784X,CTI,CTM,CTR,CWT

CYB10,CYB11,CYB12,CYB13,CYB14,IS,ISM,ISS,IT,ITS

Brief Job Description:

This position is open to U.S. Citizens and permanent residents.

This onsite role requires the selected candidate to work from an HHS office in Austin, Texas.

The Cybersecurity Analyst III performs senior-level cybersecurity operations work with emphasis on threat detection, incident investigation, security monitoring, cyber defense, and operational response activities. The role supports agency on-premises and cloud environments by identifying, analyzing, investigating, and responding to cybersecurity threats impacting agency systems, applications, hosts, networks, cloud services, and data.

The Cybersecurity Operations Center (CSOC) Analyst is responsible for monitoring enterprise security operations and coordinating the detection and response of cybersecurity incidents. This position provides senior-level expertise in threat analysis, incident triage, threat intelligence, security monitoring, and cyber defense operations. The analyst leverages advanced security technologies and investigative methodologies to identify malicious activity, assess risk, and coordinate containment and remediation activities.

The CSOC Analyst develops and maintains awareness of the agencys cybersecurity threat landscape, evaluates emerging threats and attack techniques, and supports the implementation of strategies that strengthen the agencys security posture. This position serves as a critical operational resource in protecting agency systems and data while ensuring that cybersecurity monitoring, detection, and response activities align with agency security objectives, State of Texas requirements, and industry best practices.

This position performs highly complex information security and cybersecurity analysis work. The Analyst works under limited supervision with considerable latitude for the use of initiative and independent judgment. The Analyst will research and implement new threat detection methodologies, monitoring capabilities, investigative techniques, and response strategies for the prevention, detection, containment, and remediation of cybersecurity incidents.

The Analyst provides expert guidance regarding cybersecurity threats, incident response procedures, threat intelligence findings, and emerging risks. This role partners closely with security engineering, vulnerability management, system administration, cloud operations, and application support teams to strengthen organizational cyber resilience.

Essential Job Functions (EJFs):

Attends work on a regular and predictable schedule following agency leave policy and performs other duties as assigned.

Security Monitoring & Incident Detection - 35%

• Monitors security events and alerts generated through Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR/XDR), identity security, cloud security, email security, vulnerability management, and network security platforms.
• Performs initial triage and analysis of cybersecurity alerts to determine severity, scope, impact, and potential organizational risk.
• Reviews indicators of compromise (IOCs), indicators of attack (IOAs), anomalous user activity, threat intelligence information, phishing campaigns, malware activity, and suspicious network behavior.
• Correlates events from multiple security technologies to identify attack patterns and potential cybersecurity incidents.
• Evaluates detection effectiveness and recommends improvements to monitoring capabilities and alert fidelity.

Incident Response & Investigation - 30%

• Leads and conducts investigations of cybersecurity events and incidents.
• Coordinates response activities with Incident Response, Security Engineering, Infrastructure Services, Cloud Operations, and other support teams.
• Assists with incident containment, eradication, recovery, and post-incident review activities.
• Documents investigations, findings, recommendations, lessons learned, and response actions.
• Supports forensic investigations and evidence preservation activities as appropriate.

Threat Intelligence & Threat Hunting - 15%

• Researches emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and industry threat trends.
• Performs threat hunting activities across enterprise systems and cloud environments to identify previously undetected threats.
• Leverages commercial, industry, government, and open-source threat intelligence to enhance detection and response capabilities.
• Develops recommendations for improving agency visibility into emerging threats.

Security Operations Improvement & Collaboration - 10%

• Supports development and tuning of detection use cases, analytics, dashboards, workflows, reports, and operational procedures.
• Collaborates with security engineering teams to improve monitoring coverage and telemetry collection.
• Assists with tabletop exercises, incident simulations, adversary emulation, operational readiness activities, and continuous improvement initiatives.
• Provides input into cybersecurity strategy and operational enhancements.

Other Duties - 10%

• Performs additional cybersecurity operations activities as assigned, including special projects, process improvement initiatives, operational readiness efforts, reporting activities, audit support, and agency cybersecurity initiatives.

Knowledge, Skills and Abilities (KSAs):

Knowledge of:

• Security Operations Center methodologies, operations, and best practices.
• Incident response concepts, procedures, and investigation techniques.
• Enterprise cybersecurity technologies including SIEM, EDR/XDR, IDS/IPS, NDR, NGFW, SOAR, cloud security, email security, identity protection, and vulnerability management solutions.
• Threat intelligence frameworks, MITRE ATT&CK, cyber threat actor behaviors, and attack methodologies.
• Operating systems, networking protocols, Active Directory, Microsoft Entra ID, cloud computing platforms, and enterprise security architectures.
• Security and risk management frameworks such as NIST Cybersecurity Framework, NIST 800-61, CIS Controls, and State of Texas cybersecurity requirements (including TAC Chapter 202).

Skill in:

• Written and verbal communication.
• Analyzing and solving complex cybersecurity problems.
• Conducting threat investigations and incident analysis.
• Correlating security data from diverse sources and technologies.
• Identifying risk and recommending appropriate response actions.
• Producing operational reports, technical documentation, and executive summaries.

Ability to:

• Analyze large volumes of security telemetry and rapidly identify threats.
• Make sound decisions during cybersecurity investigations and incident response activities.
• Communicate technical information to both technical and non-technical audiences.
• Work collaboratively with diverse teams and provide operational cybersecurity guidance.
• Manage multiple concurrent investigations and priorities in a fast-paced environment.

Registrations, Licensure Requirements or Certifications:

Prefer one or more of the following certifications:

• Certified Information Systems Security Professional (CISSP)
• CompTIA CySA+
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Continuous Monitoring Certification (GMON)
• Certified SOC Analyst (CSA)

Initial Screening Criteria:

• Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field is strongly preferred. Education and experience may be substituted for one another on a year for year basis.
• At least 5+ years of experience in information technology, cybersecurity, security operations, detection engineering, systems/network administration, or related disciplines.
• Experience working in a Security Operations Center (SOC).

Additional Information:

Any employment offer is contingent upon available budgeted funds. The offered salary will be determined in accordance with budgetary limits and the requirements of HHSC Human Resources Manual.

Selected candidates must be legally authorized to work in the U.S. without sponsorship.

Selected candidate must be willing to commute to the office on the required days.

#LI-IN1

Review our Tips for Success when applying for jobs at DFPS, DSHS and HHSC.

Active Duty, Military, Reservists, Guardsmen, and Veterans:

Military occupation(s) that relate to the initial selection criteria and registration or licensure requirements for this position may include, but not limited to those listed in this posting. All active-duty military, reservists, guardsmen, and veterans are encouraged to apply if qualified to fill this position. For more information please see the Texas State Auditor's Job Descriptions, Military Crosswalk and Military Crosswalk Guide at Texas State Auditors Office - Job Descriptions.

ADA Accommodations:

In compliance with the Americans with Disabilities Act (ADA), HHSC and DSHS agencies will provide reasonable accommodation during the hiring and selection process for qualified individuals with a disability. If you need assistance completing the on-line application, contact the HHS Employee Service Center at 1-888-894-4747. If you are contacted for an interview and need accommodation to participate in the interview process, please notify the person scheduling the interview.

Pre-Employment Checks and Work Eligibility:

Depending on the program area and position requirements, applicants selected for hire may be required to pass background and other due diligence checks.

HHSC uses E-Verify. You must bring your I-9 documentation with you on your first day of work. Download the I-9 Form

Telework Disclaimer:

This position may be eligible for telework. Please note, all HHS positions are subject to state and agency telework policies in addition to the discretion of the direct supervisor and business needs.