TXCC - SOC Cybersecurity Engineer (Cybersecurity Analyst II-V)

Performs complex to highly advanced cybersecurity analysis and engineering work within the Texas Cyber Command (TXCC) Unified Cyber Task Force’s (UCTF) Security Operations Center (SOC). Designs, configures, integrates, automates, secures, and maintains cybersecurity platforms and services supporting threat detection, investigation, and incident response for state agencies and other participating entities. Performs engineering activities involving security monitoring, telemetry management, detection capabilities, automation, system integrations, and operational reliability. Collaborates with cybersecurity operations, incident response, digital forensics, threat intelligence, and other internal and external partners to maintain and improve cybersecurity capabilities.

Works under the direction of the SOC Director, with varying degrees of supervision and latitude for initiative and independent judgment based on classification level. Assignments may emphasize platform and telemetry engineering, detection and automation, or exposure and service assurance, with responsibilities varying according to operational needs and technical specialization. Performs work within established authority, applicable laws, approved agreements, and organizational policies and procedures.

Essential Job Duties

• Configures, administers, secures, maintains, and improves cybersecurity platforms and supporting infrastructure, including security monitoring, endpoint protection, network security, cloud security, threat intelligence, automation, and casemanagement technologies. Identifies and resolves technical issues to maintain reliable security operations.
• Designs, implements, and maintains security telemetry collection, integration, processing, and enrichment capabilities. Onboards and validates data sources, monitors data quality and availability, and troubleshoots collection failures, data loss, and integration issues to support effective detection and investigation.
• Develops, tests, implements, and maintains scripts, application programming interface (API) integrations, and automated workflows supporting cybersecurity operations. Automates data enrichment, investigative processes, reporting, information exchange, and authorized response activities while maintaining appropriate security and operational controls.
• Develops, implements, tests, and improves security detection rules, investigative queries, correlation logic, and automated response capabilities. Incorporates threat intelligence, incident findings, and operational requirements to improve threat identification, detection accuracy, and response effectiveness.
• Monitors, evaluates, and improves the availability, performance, reliability, and resilience of cybersecurity platforms and services. Investigates system failures, identifies root causes, coordinates technical support, implements corrective actions, and maintains procedures supporting service restoration and operational continuity.
• Implements and maintains security configurations, access controls, authentication mechanisms, audit logging, and other protective measures for assigned cybersecurity platforms and services. Identifies and remediates vulnerabilities, misconfigurations, and security weaknesses in accordance with established requirements.
• Develops, tests, documents, and implements changes to cybersecurity platforms, configurations, code, detections, and integrations. Uses established changemanagement, versioncontrol, testing, and deployment procedures to minimize operational disruption, validate results, and maintain system integrity.
• Integrates and analyzes asset, vulnerability, and exposure information to support cybersecurity monitoring, risk prioritization, remediation tracking, and operational reporting. Develops and improves processes, dashboards, and automated quality checks to evaluate security coverage and control effectiveness.
• Provides technical engineering and investigative support during cybersecurity incidents, including assistance with telemetry, queries, detection capabilities, automation, and platform troubleshooting. Collaborates with incident responders and other operational teams to analyze activity, identify technical limitations, and support authorized response activities.
• Evaluates cybersecurity technologies, system architectures, and operational requirements to recommend improvements in performance, capacity, security, resilience, maintainability, and costeffectiveness. Maintains technical documentation, system diagrams, integration records, operational procedures, and other materials supporting cybersecurity services and assessments.
• Collaborates with internal teams, participating entities, vendors, and other partners to coordinate technical activities, resolve operational issues, and improve cybersecurity capabilities. Participates in training, exercises, assigned oncall support, and operationalreadiness activities; provides technical guidance and knowledge sharing; and performs other workrelated duties as assigned., * Configuring, integrating, administering, troubleshooting, and maintaining cybersecurity platforms, systems, and supporting infrastructure.
• Developing, modifying, testing, and troubleshooting scripts and automated workflows using programming or scripting languages such as Python, PowerShell, Bash, or comparable languages.
• Developing and validating investigative queries using relevant query languages, such as YARAL 2.0, Kusto Query Language (KQL), Search Processing Language (SPL), Elastic query languages, or Structured Query Language (SQL).
• Developing, testing, implementing, and improving security detections, correlation rules, automated response workflows, and related cybersecurity capabilities.
• Integrating systems and exchanging information using APIs, structured data formats, commandline tools, and other technical integration methods.
• Analyzing system performance, telemetry quality, security events, and technical failures to identify root causes, evaluate potential solutions, and implement corrective actions.
• Applying secure configuration, access management, version control, testing, deployment, and changemanagement practices to cybersecurity systems and services.
• Evaluating technical requirements, system dependencies, operational risks, and potential impacts when designing or modifying cybersecurity solutions.
• Using electronic worktracking systems, secure collaboration tools, and standard office productivity software to maintain technical documentation, prepare reports, and communicate engineering activities.
• Communicating complex technical information, operational risks, and recommended solutions clearly and effectively to technical and nontechnical audiences.

Ability to:

• Exercise sound technical judgment, take appropriate initiative, and make informed decisions when addressing complex cybersecurity engineering and operational challenges.
• Work independently within established authority while recognizing when additional expertise, resources, or escalation is necessary.
• Analyze unfamiliar technical environments, troubleshoot complex systems, and develop effective, maintainable solutions to operational problems.
• Evaluate the effects of technical changes on system security, performance, reliability, and interconnected services.
• Manage competing technical priorities, respond effectively to operational disruptions, and adapt to changing requirements and emerging cybersecurity threats.
• Maintain accountability for assigned systems and deliverables, communicate risks or errors promptly, and follow corrective actions through completion.
• Collaborate effectively with multidisciplinary teams, participating entities, vendors, and other stakeholders to implement and maintain cybersecurity capabilities.
• Protect confidential and sensitive information and maintain the security and integrity of cybersecurity platforms, technical records, and operational data.
• Learn and apply emerging technologies, engineering practices, and cybersecurity tools in support of organizational needs.
• Provide technical guidance, share knowledge, evaluate the work of others, and contribute to improvements in engineering practices and operational readiness.

Working Conditions

Work is performed in office, remote, and authorized field environments and involves prolonged computer use, configuration and testing of cybersecurity technologies, analysis of sensitive operational information, and collaboration with multidisciplinary teams and external partners.

Requires participation in assigned oncall coverage and availability to provide afterhours technical support for cybersecurity incidents, platform failures, critical system changes, exercises, or continuity operations. May require extended work hours, including evenings, weekends, and holidays, during operational disruptions, maintenance activities, or periods of increased demand.

Requires occasional travel, including on short notice, to support technical deployments, partner coordination, training, or other assigned activities.

Must maintain regular and punctual attendance, safeguard confidential and sensitive information, and comply with applicable security and professional certification requirements.

Must meet applicable U.S. citizenship requirements, successfully complete required background screening, and maintain eligibility to access the systems, facilities, and information necessary to perform assigned duties. Must successfully complete and maintain applicable operationalreadiness, incidentmanagement, and other required training within established timeframes., Cybersecurity Analyst II: Graduation from an accredited college or university with an associate degree.

Cybersecurity Analyst III, IV, or V: Graduation from an accredited college or university with a bachelor’s degree.

Experience:

Cybersecurity Analyst II:

Two years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including handson experience in cybersecurity engineering, security platform administration, systems integration, detection engineering, or security automation.

Cybersecurity Analyst III:

Four years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including at least two years of handson experience in cybersecurity engineering, security platform administration, telemetry engineering, detection engineering, security automation, or cybersecurity systems integration.

Cybersecurity Analyst IV:

Seven years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including at least three years of handson cybersecurity engineering experience.

At least one year of experience leading technical engineering projects, coordinating complex system implementations, or directing the technical work of others.

Cybersecurity Analyst V:

Ten years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including at least four years of handson cybersecurity engineering experience.

At least four years of experience providing technical leadership in cybersecurity engineering, security architecture, complex systems integration, or enterprise cybersecurity infrastructure, including responsibility for major technical implementations or crossplatform engineering initiatives.

Note:

Required handson technical experience and technical leadership experience may overlap with the total years of professional experience required for the applicable classification level.

Experience used as a substitution for formal education must be additional to the required professional experience and may not be counted twice.

Additional Experience Required for All Levels:

Experience developing, testing, and troubleshooting scripts or code for cybersecurity automation, and independently writing and validating queries that retrieve and analyze security or operational data.

Experience configuring, integrating, troubleshooting, or maintaining cybersecurity technologies and supporting technical infrastructure.

Experience implementing technical solutions to meet operational or security requirements, including evaluating system dependencies, testing functionality, troubleshooting failures, and documenting results.

Licensure:

Cybersecurity Analyst II: One foundational cybersecurity certification.

Cybersecurity Analyst III: One foundational and one intermediate cybersecurity certification.

Cybersecurity Analyst IV: One foundational and one advanced practitioner cybersecurity certification.

Cybersecurity Analyst V: One of the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Certified in Risk and Information Systems Control (CRISC).

Qualifying certifications include:

Foundational: CompTIA Security+, GIAC Security Essentials (GSEC), or Systems Security Certified Practitioner (SSCP).

Intermediate: CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Forensic Examiner (GCFE), or CompTIA PenTest+.

Advanced Practitioner: GCIH, GCIA, GCFA, GCDA, GDAT, GREM, GPEN, GWAPT, GNFA, GMON, CEH, or OSCP.

Acceptable Substitutions

Additional related work experience may be used to substitute the formal education requirement on a yearforyear basis. Candidates must possess a high school diploma or equivalent certificate.

Experience used as a substitution for formal education must be additional to the required professional experience and may not be counted twice.

Preferred Qualifications

Experience:

Experience engineering or administering enterprise security information and event management (SIEM), endpoint security, network monitoring, cloud security, or cybersecurity automation platforms.

Experience with Google SecOps, including the Unified Data Model (UDM), YARAL 2.0, datasource integration, parser validation, or detection engineering.

Experience with Cyware, Corelight/Zeek, SentinelOne, CrowdStrike, Microsoft Defender, Palo Alto, or comparable cybersecurity technologies.

Experience developing or maintaining API integrations, infrastructure as code, continuous integration and deployment processes, automated detection content, or scalable security telemetry solutions.

Experience supporting cybersecurity operations across multiple organizations, government entities, critical infrastructure, or managed security environments.

Experience improving cybersecurity service reliability, detection coverage, operational efficiency, or automated security processes.

Additional professional certifications or advanced technical training relevant to cybersecurity engineering, security architecture, cloud technologies, detection engineering, or automation.

Knowledge/Skills/Abilities

Knowledge of:

• Cybersecurity principles, practices, standards, controls, and applicable laws, policies, and procedures.
• Computer operating systems, enterprise networks, cloud environments, identity and access management, and associated cybersecurity technologies.
• Security information and event management (SIEM), endpoint detection and response (EDR), network security, threat intelligence, security automation, and related cybersecurity platforms.
• Cybersecurity engineering principles, including system integration, application programming interfaces (APIs), scripting, structured data, authentication, secure configurations, and version control.
• Security telemetry collection, data processing, normalization, enrichment, detection engineering, and automated response workflows.
• System architecture, software development practices, change management, access controls, vulnerability management, and cybersecurity service reliability.
• Cybersecurity threats, vulnerabilities, adversary tactics and techniques, incident response processes, and methods for evaluating security detection and control effectiveness.

The Texas Cyber Command (TXCC) is the state’s front line of cyber defense, established by the 89th Texas Legislature to protect Texans, critical infrastructure, and government systems from evolving cyber threats. Headquartered in San Antonio (a national hub of cybersecurity talent), TXCC unites threat detection, incident response, and statewide cyber readiness under one missiondriven agency to establish Texas as the most cyberresilient state in the nation. At TXCC, your work doesn’t just sit in a queue it actively secures, protects, defends, and educates over 31 million Texans every day.