Cyber Intelligence Center- Cyber Incident Manager

San Bernardino County’s Innovation and Technology Department (ITD) is seeking qualified and motivated professionals to serve as the Cyber Intelligence Center (CIC)- Cyber Incident Manager (CIM)*. The County’s CIC protects and monitors critical government services and systems in a highly regulated environment, residents’ data assets, and departmental operations.

In this role, you will oversee countywide cybersecurity events and incidents from initial triage through recovery, lead daily CIC briefings to establish priorities, and coordinate a unified threat-informed response.

The CIC CIM is a subject-matter expert responsible for:

• Managing and leading the County’s CIC staff in coordinating analysis, responses (e.g., Threat Modeling), containment/eradication, recovery, and post-incident activities of cybersecurity incidents.
• Knowledgeable in the selection and application of various threat models.
• Coordinating activities across the County with affected departments’ leadership and technical teams, legal and privacy personnel, external partners, etc.
• Overseeing the incident lifecycle, including detection, analysis, containment, evidence preservation, eradication, recovery, and post-incident improvements in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-61r3 and NIST Cybersecurity Framework 2.0.
• Monitoring incident response activities and service-level agreements with the County’s Managed Detection and Response (MDR) Services partner.
• Administer, support, and formulate relevant County / ITD policies, standard practices, and procedures.
• Lead, develop, and administer table-top exercises throughout the County / ITD as required.
• Provide presentations, briefings, etc. as required to County and departmental leadership.
• Ability to translate technical cyber information into layman’s terms for briefings, after-action reports, etc.
• Ability to identify, quantify, and maintain relevant incident response matrices, tracking Mean-Time-To-Respond (MTTR), etc.
• Manage the County’s Security Information and Event Management (SIEM) environment that includes but not limited to the architecture, connectors, analytics, watchlists, workbooks, etc.
• Develop SIEM automation rules and logic app playbooks to codify containment and enrichment, integrating identity, endpoint, email, and network actions while preserving forensic evidence.
• Promoting ITD security cultural norms, including outcome-based execution, fact-based problem-solving, a sense of urgency, and collaboration.
• Managing, leading, and developing Information Security Analysts and other CIC team members.

Official job title: Information Security Analyst III; for detail refer to the Information Security Analyst III job description.

ABOUT THE DEPARTMENT The Innovation and Technology Department is San Bernardino County’s primary technology service provider entrusted with managing and safeguarding the County’s enterprise mission critical systems and infrastructure. It is our goal to empower the County through innovation and enterprise solutions that promote progress through technology and provide transparency and mobility that enable staff to focus on addressing and resolving issues toward the progress of the County’s mission, ensuring continued success. Learn more about our initiatives in IT’s Strategic Plan ., San Bernardino County is an Equal Employment Opportunity (EEO) and Americans with Disabilities Act (ADA) compliant employer, dedicated to ensuring equal employment opportunities for all employees and applicants.

Pre-Employment Process: Selected candidates must successfully pass a background check and a job-related physical exam, including a drug test, prior to employment.

Availability: Incumbents may occasionally work evening and weekend hours. Some overtime, on-call, or call back work may be required. Sponsorship: San Bernardino County is unable to consider candidates who require visa sponsorship at this time or in the future. Candidates must be able to present their legal right to work in the United States.

Minimum Requirements

Qualifying candidates must meet the requirements in ALL of the following categories:

EXPERIENCE:

Five (5) years of full-time equivalent experience assisting with the implementation, management, and monitoring of IT security solutions and programs.

LEADERSHIP: Three (3) years of full-time experience leading a Security Operations Center (SOC) in a medium-to-large enterprise, including incident triage and escalation, SIEM oversight (e.g., Microsoft Sentinel), and coordination across identity, endpoint, email, and network security teams. Experience may be concurrent.

EDUCATION: Sixty (60) semester (90 quarter) units of completed courses from an accredited** college or university in information technology, computer science, software engineering/programming, or a related field.

SUBSTITUTION: One (1) additional year of qualifying work experience may substitute for the education requirement.

**Qualifying degrees and coursework must be conferred by institutions accredited by an accrediting body recognized by the U.S. Department of Education. Degrees earned outside the United States must be accompanied by an evaluation from a recognized credential evaluation service verifying U.S. equivalency., * A bachelor’s degree in information security, computer science, business administration, public administration, or a related field, or equivalent experience

• Microsoft security stack (e.g., Defender, Sentinel, Entra ID), SIEM/EDR, and KQL-based analytics
• Excellence in executive and stakeholder communication; ability to produce briefings and after-action reports/reviews to formulate corrective actions plan.
• Ability to integrate external intelligence from but not limited to MS-ISAC, CISA, and CAL-CSIC, enrich indicators, and verify enforcement across County controls
• Must demonstrate strong, steady leadership in a high-stress, time-compressed environment, making clear decisions, communicating calmly, and guiding cross-functional teams to execute incident actions with urgency and discipline.

San Bernardino County is located in the heart of Southern California, home to over 2 million residents, encompassing 20,160 square miles from the Nevada State line and the Colorado River to the LA County line. This gives San Bernardino County a diverse climate and geography, from mountains as high as 11,502 feet, to the desert as low as 181 feet, and beautiful valleys in between. Pristine lakes and rivers, snow-capped mountain resorts, flowering deserts, and many other family-oriented recreational attractions take advantage of the natural assets of the area, most within an hour’s drive. Families enjoy affordable housing, excellent schools, colleges and universities, and easy access to airports, hospitals, libraries, and parks. The County provides a safe, clean and healthy environment for residents. A variety of shopping and business opportunities abound, in this, the largest County in the contiguous United States.