IT Security Analyst - Journey (Lacey)

State of Washington•Thurston County – Lacey, WA

6d•Hybrid

About The Position

Washington State Parks and Recreation Commission is hiring a full-time IT Security Analyst – Journey to help protect the systems, data, and technology services that support the agency’s mission, staff, and residents across Washington. The position is part of the Parks Information Security Office within the IT Services Department and reports to the Chief Information Security Officer (CISO). It is a hands-on technical security role supporting enterprise cybersecurity operations, including vulnerability management, disaster recovery, secure system configuration, incident response support, and security-driven technical administration. The analyst serves as a point of contact for technical and process-related security design, implementation, configuration, and support for IT professionals and engineers working on systems and network defense. Working closely with the Senior Specialist, and with guidance from the Senior Analyst and IT Architect, the analyst helps design, implement, and maintain solutions that support the agency’s IT security posture and ensure compliance with state and Parks security policies and procedures. The role collaborates with IT operations, network infrastructure, compliance, and agency staff to identify risks, strengthen security, and support reliable technology services. After onboarding and training, the position is eligible for remote, partial telework, and flexible scheduling. The default assigned work location is within Washington State; onsite frequency varies with business and operational needs. Some travel may occasionally be required.

Requirements

Six years of consultative, administrative, or supervisory experience in IT security analysis, information security system implementations, and security application configuration and maintenance; or a bachelor’s degree in computer science, management information systems, or a closely related field and two years of consultative, administrative, or supervisory experience in information technology security.
Experience and ability in at least half of the following areas: systems/network security; web application and development security; risk management; network discovery and vulnerability assessments; malware analysis; compliance audits; and log management.
Ability to identify and document security vulnerabilities and their potential business impact.
Experience implementing and monitoring security controls.
Strong communication skills, including clear verbal communication and concise, organized writing for varied audiences.
Customer focus, including developing customer relationships, resolving customer problems, providing attentive service, and incorporating feedback.
Interpersonal skills, including respectful and tactful communication, diplomacy, and fostering transparent communication.
Problem-solving skills, including rigorous analysis and developing effective solutions to difficult problems.
Organizational skills, including prioritizing work, managing multiple activities, gathering resources, and arranging information effectively.
Takes action to meet the needs of others.

Nice To Haves

Professional certification such as CISSP, CCSP, CRISC, GSEC, CEH, or Security+.
At least three years of experience developing, implementing, and enforcing agency information systems security policy, operating procedures, and technical standards.
Three years of experience designing and applying security controls and processes for an organization or agency.
At least two years of experience identifying and resolving information security risks and incidents that may adversely affect agency operations or projects.
At least two years of project management experience, preferably focused on information technology or IT security.
Experience managing IT security in third-party cloud environments.
Experience with compliance management, particularly NIST, CJIS, PCI, and OCIO 141.10.
Experience managing and maintaining security controls in Azure.

Responsibilities

Monitor, maintain, and configure systems related to risk, threat, and vulnerability management.
Use threat and vulnerability management tools to identify and remediate infrastructure vulnerabilities, coordinating with other teams and technical staff on timely remediation plans.
Monitor SIEM solutions and create custom queries and alerts.
Assess agency systems for compliance with IT security policy, identify configuration changes that could improve security, and recommend remediation of findings.
Provide technical resources and expertise to internal and external Security Design Review processes for systems, applications, IoT devices, and IT business solutions.
Complete required Security Design Review documentation and approval steps under the guidance of the Senior Analyst, using established OCS and Parks processes and tools.
Maintain current knowledge of IT and cybersecurity policies and standards that may affect Parks systems and business practices.
Serve as a subject matter expert and resource for developing baseline security standards for IT hardware and software, IoT devices, network and mobile devices, and cloud-based solutions.
Attend and actively participate in WaTech Security Operations Center, Office of Cyber Security, and WaTech Risk and Policy Office meetings, representing Parks interests.
Technically review mobile applications during intake and assessment for security concerns and suitability under current policies and standards.
Participate in security exercises evaluating the agency’s Disaster Recovery Plan, Business Continuity Plan, Continuity of Operations Plan, and Incident Response plan.