Security Analyst II – Threat Hunter (ISS7)

State of Oregon•Salem, OR

17d•$6,846 - $10,344•Hybrid

About The Position

The Department of Administrative Services’ Enterprise Information Services (EIS) is a state government-wide IT organization led by Oregon’s State Chief Information Officer. Within EIS, Cyber Security Services (CSS) leads efforts to safeguard Oregon’s information resources and includes the Security Operations Center (SOC), among other units. The Security Analyst II – Threat Hunter continuously monitors Microsoft Sentinel and Defender XDR for security threats, performs initial triage to validate and assess alerts, conducts network threat detection and analysis, and provides timely, actionable notifications and escalations to support incident response and protect state agencies from cyber threats. The position is full-time, permanent, and hybrid, with an expected in-office schedule of one day per week. The position requires a valid driver’s license and CJIS clearance. Applicants must be authorized to work in the United States; visa sponsorship is not available.

Requirements

One of the following qualification pathways: six years of information systems experience in Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps; Attack Surface Reduction (ASR); device timeline; evidence and response actions; Live Response sessions; and EDR forensics; OR an associate degree in Computer Science, Information Technology, or a related field, or completion of a two-year accredited vocational training program in IT or a related field, plus four years of the specified experience; OR a bachelor’s degree in IT, Computer Science, or a related field, plus two years of the specified experience; OR a master’s degree in IT, Computer Science, or a related field, which may substitute for the other pathways.
Must be authorized to work in the United States; applicants requiring visa sponsorship will not be considered.
Must possess and maintain a valid driver’s license issued by the state where the employee resides.
Must obtain and maintain CJIS clearance.
Finalists are subject to a computerized criminal history check; adverse background data may result in disqualification.

Nice To Haves

Ability to perform deep incident investigations using Microsoft Sentinel Investigation Graph, UEBA, and similar SIEM, XDR, EDR, and security investigation platforms.
Ability to pivot across security tools and data sources such as Defender, Sentinel, Purview, Entra ID, Tenable One, email security, firewall, proxy, and network monitoring platforms.
Advanced KQL skills, including complex queries, joins, unions, time-series queries, anomaly detection patterns, custom hunting queries, and scheduled analytics rules.
Strong proficiency investigating and correlating security telemetry across identity, endpoint, network, cloud, and email environments, including Entra ID sign-in logs, Microsoft 365 audit logs, Windows event logs including Sysmon, DNS, proxy, VPN, firewall, EDR, and network flow data.
Ability to identify credential compromise, privilege escalation, lateral movement, command-and-control activity, persistence mechanisms, and data exfiltration.
Strong understanding of adversary tradecraft and attack methodologies, with the ability to map findings to the MITRE ATT&CK framework.
Ability to use internal and external threat intelligence to enrich investigations and identify emerging adversary techniques.
Ability to recommend and execute incident response actions and improve detection and response capabilities.
Experience securing, monitoring, and investigating threats in AWS environments, including IAM, CloudTrail, GuardDuty, and cloud-native logging and security services.
Demonstrated ability to collaborate with teammates and build positive business relationships with superiors, subordinates, peers, and others outside the organization.
Preference may be given to candidates with one or more of these certifications: CISSP, SC-200, SC-100, AZ-500, CompTIA CySA+ or Security+, GIAC GCIA, GCIH, or GMON, or closely related certifications.

Responsibilities

Continuously monitor Microsoft Sentinel and Defender XDR for security threats.
Perform initial triage to validate and assess security alerts.
Conduct network threat detection and analysis.
Provide timely, actionable notifications and escalations to support incident response and protect state agencies from cyber threats.
Investigate incidents and threats across security tools and data sources, determine attack scope, and support incident response.
Develop threat-hunting hypotheses using internal and external threat intelligence and proactively detect malicious activity.
Translate hunting findings into detections, analytics rules, correlation logic, automation workflows, and improvements to detection and response capabilities.
Recommend and execute response actions such as device isolation, account containment, IP or domain blocking, detection tuning, and rule development.
Manage the incident response lifecycle from detection and triage through scoping, containment, eradication, recovery, and post-incident review, including root-cause analysis, documentation, and communication.
Collaborate with teammates and build positive working relationships with colleagues and others outside the organization.

Benefits

Low-cost medical, vision, and dental plans for employees and families.
Life insurance and short- and long-term disability coverage.
Deferred compensation savings plans.
Flexible spending accounts for health and childcare.
Optional benefits, including life insurance, disability coverage, and FSA.
11 paid holidays and 3 personal business days.
Monthly sick leave and vacation leave that increases with years of service.
Professional growth and advancement opportunities.
Hybrid work opportunity, with an expected in-office schedule of one day per week.
Access to Get There, Oregon’s carpool matching tool and trip planner.
Potential eligibility for Public Service Loan Forgiveness.