Sr. IT Security Administrator

County of Orange • Orange County, CA

2d • Hybrid

About The Position

The Orange County Sheriff’s Department is seeking a Sr. IT Security Administrator to join their Technology Division. This role is responsible for supervising a team of security analysts who ensure the overall security of the O.C. Sheriff's network. The administrator will focus on preventing and mitigating malicious attacks, ensuring network compliance with CJIS requirements, administering security controls, and providing security awareness training. This position offers an excellent opportunity to contribute to public safety through innovative technology solutions.

Requirements

• Three years performing security administration at a level that is comparable to the County of Orange classification of IT Security Administrator II.
• College level education or training directly related to the competencies and attributes required of the position may be substituted for up to one year of the required experience at the rate of three semester units or the equivalent, equaling one month of experience and one hour of training equaling one hour of experience.
• College level education or training beyond a bachelor's degree, which is directly related to the competencies and attributes required of the position, may be substituted for up to an additional year of required experience at the same rate identified above.
• Applicants must not have been convicted of a felony or be on any form of probation and must pass an extensive background investigation to the satisfaction of the Orange County Sheriff-Coroner.
• Background screening includes completing of a Personal History Form, interview with a background investigator, fingerprinting and may include a polygraph test.
• Some of the areas considered in the background screening include prior convictions, traffic violations, drug use and credit problems, employment history, professional references and education verification (i.e. degree, license, or official transcripts).
• Foreign degrees require an evaluation of U.S. equivalency by an agency that is a member of the National Association of Credentials Evaluation Services (N.A.C.E.S.).

Nice To Haves

• Progressively responsible experience administering enterprise security technologies.
• Analyzing endpoint, identity, network, email, and cloud telemetry.
• Investigating and documenting incidents.
• Managing vulnerabilities and remediation.
• Applying risk-based security controls.
• Understanding of Active Directory and Entra ID.
• Understanding of networking and firewall concepts.
• Understanding of Windows/Linux and cloud fundamentals.
• Scripting or automation skills.
• Change management experience.
• Evidence handling experience.
• Familiarity with security frameworks.
• Strong analytical writing skills.
• Strong customer service skills.
• Strong teamwork skills.
• Discretion.
• Ability to explain risk to technical and executive audiences.
• OCSD-specific systems, procedures, and agency relationships.
• Advanced incident response and threat investigation.
• Administration of SIEM/XDR/SOAR and endpoint controls (Palo Alto XSIAM/XDR experience is especially relevant).
• Identity and privileged-access security.
• Vulnerability and exposure management.
• Cloud and network security.
• Detection engineering and automation.
• Documented experience applying CJIS, NIST, ISO, or comparable control frameworks.
• Sound independent judgment.
• Calm incident leadership.
• Concise documentation.
• Cross-team influence.
• Respect for change control and public-sector accountability.
• Possession of a valid California driver's license, Class C or higher (depending upon assignment).
• Demonstrated professional level competency and/or certification pertaining to the information technologies used by the County may be required (Certifications such as CISSP and SSCP and may be required).

Responsibilities

• Monitor security telemetry; validate and prioritize alerts; investigate suspected compromise; contain, eradicate, and coordinate recovery; preserve evidence; and document incidents in the approved case-management and ServiceNow workflows.
• Administer and tune enterprise security platforms, including Palo Alto XSIAM/XDR, endpoint controls, security integrations, email-security tooling, logging pipelines, detection rules, dashboards, and automated response playbooks.
• Conduct vulnerability, exposure, and risk management: assess findings, validate exploitability and business impact, assign remediation priorities, coordinate corrective actions, verify closure, and report residual risk.
• Engineer and support identity-security controls for Active Directory and Microsoft Entra ID, including privileged access, PIM, MFA, conditional access, service accounts, guest access, and least-privilege reviews.
• Evaluate and document compliance with CJIS/CLETS, NIST, ISO, PCI, HIPAA, County policy, and applicable retention requirements; support audits, evidence requests, control testing, exceptions, and corrective-action plans.
• Provide security architecture and engineering review for infrastructure, cloud, application, network, remote-access, and third-party initiatives; define controls and securely integrate new technologies without disrupting public-safety operations.
• Develop and maintain security standards, procedures, runbooks, knowledge articles, asset/control documentation, metrics, risk registers, and executive or operational reports; perform work through approved change-management processes.
• Partner with Network, Server/Storage, Applications, Service Desk, executives, County stakeholders, law-enforcement agencies, and vendors to resolve security issues, improve awareness, and coordinate enterprise remediation.
• Manage vendor and agency security coordination, including technical due diligence, access requirements, support escalations, product evaluations, incident communications, and validation of contractual security commitments.
• Maintain professional readiness through threat research, product training, exercises, and knowledge transfer; participate in after-hours incident response, maintenance, and on-call coverage when assigned.

Benefits

• Salary may be negotiable within the range listed above, based on position requirements and successful candidate's qualifications, subject to appropriate authorization.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: Associate degree