Information Security Analyst III

This is a continuous filing exam. Next filing cut-offs are at 5:00 pm on: 10/2/2026, 10/16/2026 (Final) Under general supervision, leads, plans, schedules, and oversees the work of Information Security Analysts Level I/II (ISA I/II) while performing the same and/or more difficult duties as those being led; ensures completion of tasks in accordance with established policies and procedures; communicates policies, procedures, and job expectations; and provides training to staff. Utilizes skills that require technical expertise and an understanding of complex information security programs, integrating privacy and security concerns with, with, and fostering, an accountable and information security-conscious culture. The Information Security Analyst III (ISA III) is responsible for ensuring that the County’s security and privacy posture stays in alignment with County policies, standards, and guidelines and all applicable Federal, State, and local laws through ongoing testing and periodic auditing.

Examples of Knowledge and Abilities

Knowledge Of:

• Principles and practices of leadership, mentoring, and training
• Applicable federal, state, and local laws, codes, and regulations
• Operational characteristics, services, and activities of assigned programs and functions
• Enterprise Networking, Identity Management, and Data Processing Technologies
• Office procedures, methods, and equipment including computers and applicable software applications such as word processing, spreadsheets, databases, and other specialized applications related to area of assignment
• English usage, spelling, grammar, and punctuation
• Information security solutions for data, application and infrastructure protection
• Metrics that demonstrate information security control effectiveness
• Regulatory changes that affect information security policy, standards and procedures
• Corrective actions to comply with applicable regulations and policies
• Security issues, techniques and implications across all existing computer platforms
• Security auditing and disaster recovery design
• Risk assessment methods and technologies
• Legal and regulatory security developments
• Reporting on information security

Ability To:

• Lead and train Information Security Analyst Level I/II staff
• Plan, coordinate, assign, and review the work of staff
• Identify and respond to advanced persistent threats
• Provide work direction and instruction
• Research and evaluate work problems, and recommend solutions
• Develop and maintain cooperative, effective working relationships with others
• Communicate clearly and concisely, both verbally and in writing
• Interpret and apply applicable federal, state, and local laws, codes, and regulations
• Apply customer service skills, including the identification of customer needs and follow up to ensure customer commitments have been met
• Develop metrics to demonstrate information security control effectiveness
• Keep apprised on information security policy, standards and procedures
• Define information security services to meet business needs
• Recommend corrective actions to comply with Federal regulations and County policies
• Develop strategies and plans to enforce security requirements and address identified risks
• Provides guidance on business continuity and disaster recovery design
• Monitor compliance with security policies, standards, guidelines and procedures
• Monitor the legal and regulatory environment

• Conduct security audits, A valid California Driver License, Class C or higher, may be required at the time of appointment. Failure to obtain or maintain the appropriate California Driver License, or comply with state and federal requirements for utilization, may constitute cause for personnel action in accordance with Civil Service Rules or applicable bargaining agreement. Individuals who do not meet this requirement due to disability will be reviewed on a case-by-case basis. Physical Requirements: Some positions in this class require the incumbents to be able to:

• Distinguish between different colors.
• Lift equipment that weighs up to 50 pounds.

Individuals who do not meet these requirements due to disability will be reviewed on a case-by-case basis., Applicants are required to provide a full and complete response to each supplemental question. The Supplemental Questionnaire is located in the tab marked “Supplemental Questions”. Please be descriptive in your response. Note: Responses of “See Resume” or “See Application”, or copy and paste of work experience are not qualifying responses and will not be considered.

• Supplemental Questionnaires must be submitted by 5:00 p.m. on the cut-off date. Employment Services is not responsible for any issues or delays caused by an applicant’s computer or web browser. Applicants will be automatically logged out if they have not submitted their applications and all documentation prior to 5:00 p.m. on the cut-off date.
• The supplemental questions are designed to elicit specific information regarding a candidate’s experience, education, and training. Responses should be consistent with the information on your application and are subject to verification.
• Please provide place of employment, pertinent dates, and concise, descriptive and detailed information for each question.
• If a job included responsibilities applicable to several questions, separate the different functions of the job to answer all the questions completely.
• Resumes or referral to the application or other questionnaire responses will not be accepted in lieu of completing each question.
• If you have no experience, write “no experience” for the appropriate question.
• For many individuals, it is more efficient to develop responses to the supplemental questions in a word processing document and then paste them into the final document to be submitted. Changes or corrections to your Supplemental Questionnaire cannot be made once your application packet has been submitted.
• If the Supplemental Questionnaire is used in the Formula Rate exam, failure to complete all of the questions or incomplete responses will result in a lower score. While scoring the Supplemental Questionnaire, the candidate’s application and/or attachments will not be reviewed, therefore, a candidate’s responses to the questions should be accurate, thorough, detailed, and complete.

Two years (2) of full-time paid professional experience in information security or closely related field, with experience in one or more of the following areas: conducting in-depth risk analyses, developing advanced security controls, and leading security or compliance projects and initiatives. Note: Completion of coursework in Cybersecurity, Computer Science, Information Systems, Information Technology, or other field closely related to the intent of the class at an accredited college or university may be substituted for up to one year of the required experience. Related education substitutions for the required experience are computed on the basis of 3 semester units or 4.5 quarter units = 1 work month.

Note: If the word “experience” is referenced in the minimum qualifications, it means full-time paid experience unless the minimum qualification states that volunteer experience is acceptable. Part-time paid experience may be accumulated and pro-rated to meet the total experience requirements.

Some positions in this class require the incumbents to:

• Work weekends, holidays, and non-routine hours.
• Travel occasionally.

Probationary Period

The probationary period for this classification is Twelve (12) months.