Senior Cybersecurity Engineer – Security Engineering & Security Operations

City of Tacoma•Tacoma, WA

2d•Hybrid

About The Position

The City of Tacoma is hiring up to two Senior Cybersecurity Engineers to protect critical public services and the systems that support them. This role is mission-driven, valuing technical excellence, collaboration, and community service. Candidates will be considered for either the Security Engineering track or the Security Operations track based on their strengths, experience, and interests. The positions require technical expertise, communication, collaboration, mentorship, and teamwork skills. Senior Cybersecurity Engineers safeguard the City's technology, information systems, and critical services, strengthening cybersecurity maturity aligned with CIS Controls and NIST RMF, while supporting compliance obligations such as CJIS, HIPAA, PCI DSS, NERC CIP, and applicable RCW requirements. They work collaboratively with IT teams and business units to enhance cybersecurity visibility, engineer controls, reduce vulnerabilities, manage threats, and ensure the confidentiality, integrity, and availability of City assets.

Requirements

Bachelor's degree in information technology, cybersecurity or directly related field
4 years of progressively responsible information technology experience related to assignment
Equivalency: 1 year of experience = 1 year of education
Security+ or related certification (CISSP, SANS, GIAC, COMTIA)
As Assigned: Washington State Driver's License; some positions may require the ability to pass additional background checks and / or obtain additional certifications, with maintenance thereafter
On-call participation is required
Ability to obtain CJIS/HIPAA/PCI/NERC CIP access
Security Engineering Skills: Secure design review and threat modeling
Security Engineering Skills: Security tool engineering (SIEM pipelines, identity systems, endpoint agents)
Security Engineering Skills: Configuration baselines and secure hardening
Security Engineering Skills: Vulnerability engineering and automation
Security Engineering Skills: Cyber supply chain assessment and vendor risk analysis
Security Engineering Skills: CIS/NIST RMF implementation
Security Engineering Skills: Scripting & Automation familiarity (Python/PowerShell)
Security Operations Skills: SIEM/SOAR administration and detection tuning
Security Operations Skills: Endpoint security administration
Security Operations Skills: Security investigations and incident response
Security Operations Skills: Threat hunting and MITRE ATT&CK familiarity
Security Operations Skills: Scripting familiarity (Python/PowerShell)
Communication, customer service, and collaboration skills

Responsibilities

Security Engineering Track: Conduct secure design reviews and threat modeling for new systems and major changes; identify risks, propose controls, and document decisions.
Security Engineering Track: Engineer, deploy, integrate, and maintain cybersecurity tools such as SIEM pipelines, endpoint protection, identity security systems, and network security controls.
Security Engineering Track: Develop and maintain secure configuration baselines across operating systems, cloud platforms, and network infrastructure; monitor drift and drive remediation.
Security Engineering Track: Improve vulnerability management through engineering, ensuring scanning accuracy, coverage, asset associations, and workflow automation.
Security Engineering Track: Define and strengthen identity security requirements, including MFA, privileged access pathways, and conditional access policies.
Security Engineering Track: Perform cyber supply chain risk assessments for vendors, cloud services, data flows, and procurement processes.
Security Engineering Track: Produce compliance evidence and publish technical standards to support CJIS/HIPAA/PCI/NERC CIP/RCW requirements.
Security Engineering Track: Guide and mentor junior analysts and engineers in Security Engineering.
Security Engineering Track: Promote a customer service-oriented approach to Security Engineering.
Security Operations Track: Design, tune, and manage SIEM/SOAR detection logic to improve alert fidelity and reduce false positives.
Security Operations Track: Lead incident response and event triage, classifying, investigating, containing, and coordinating remediation of security events.
Security Operations Track: Conduct proactive threat hunting across logs, endpoints, identities, and networks.
Security Operations Track: Own operational vulnerability management including scanning, validation, prioritization, ticketing, and reporting against SLAs.
Security Operations Track: Maintain and tune security tools including EDR, SOAR, email security filters, and log pipelines.
Security Operations Track: Onboard log sources and verify telemetry quality, collaborating with IT owners to resolve data gaps.
Security Operations Track: Develop SOC procedures and operational standards, producing reports and compliance evidence.
Security Operations Track: Guide and mentor junior analysts and engineers in Security Operations.
Security Operations Track: Promote a customer service-oriented approach to Security Operations.