Office of Cyber Security IT Security Analyst (DoIT #10117492)

To maintain an adequate security posture by developing appropriate IT security policies, standards, and procedures with periodic updates to accurately reflect ever changing technology, legislative and user needs.

The OCS has the responsibility in protecting and monitoring the State of New Mexico¿s technology infrastructure and digital assets, including state agencies, mission critical systems and data.

Cyberattacks are dramatically increasing, and cybersecurity operations are facing new challenges. Cybersecurity is not just an IT problem anymore, it is a critical business risk, homeland security and public safety threat, voter confidence issue, and an economic development opportunity.

Technology continues to evolve, the cybersecurity landscape is constantly changing, increasing potential vulnerabilities and risk. Therefore, it is essential for the State Chief Information Security Officer (CISO) to secure additional security analysts to support the Office of Cybersecurity.

THIS POSTING WILL BE USED FOR ONGOING RECRUITMENT AND MAY CLOSE AT ANY TIME. APPLICANT LISTS MAY BE SCREENED MORE THAN ONCE. Why does the job exist?

The IT Security Analyst plays a critical role in advancing the mission of the Office of Cybersecurity (OCS) to protect the State of New Mexico’s digital infrastructure. This position is responsible for overseeing the security of information systems and ensuring that services, vendors, and stakeholders meet all applicable legal, safety, and quality standards., Assist with implementing proactive cybersecurity compliance strategies Assist with identifying and addressing potential compliance risks Assist with introducing and improving technologies and processes to strengthen security posture Provide threat assessment, monitoring, and incident response strategies Providing consultative and training services with a security first focus The analyst will also manage cybersecurity services delivered to state agencies, K-12 public schools, higher education institutions, local governments, and tribal entities. These services include:

• Vulnerability management
• Attack surface management
• Penetration testing
• User security awareness training

This role ensures that OCS remains a trusted partner by driving effective security strategies and maintaining a strong compliance and risk management framework across the states digital ecosystem. How does it get done?

The IT Security Analyst is responsible for safeguarding the confidentiality, integrity, and availability of the State of New Mexico¿s information systems. This role supports the Office of Cybersecurity by leading and executing a wide range of security operations, compliance, and incident response activities.

Security Governance and Compliance

• Assist with the Code-Stack Vulnerability Scanning Program. Overseeing, all technical on-boarding, scoping, scanning operations, and coordination with agency development teams.
• Assist with the creation and review of cybersecurity documentation, including:
• Security policies and procedures
• Configuration and change management plans
• Ensure compliance with NIST 800 series and other applicable frameworks
• Interpret and communicate regulatory and compliance requirements to stakeholders

Security Operations Center (SOC) and Monitoring

• Monitor systems and logs using SIEM tools to detect and respond to anomalies
• Conduct threat hunting and analyze indicators of compromise (IOCs)
• Review and update security tools to block malicious IPs and signatures
• Escalate incidents and coordinate with state agencies and third-party partners
• Maintain documentation of all actions taken during investigations
• Develop chat bots and data visualizations
• Automate and standardize processes to enhance efficiency, precision and scalability of security operations center activities using a SOAR
• Develop, refine, and implement automated response playbooks that streamline repetitive SOC tasks such as alert triage, enrichment, correlation, containment, and notification
• Maintain documentation of all actions taken during investigations

Risk Management and Incident Response

• Provide oversight for risk assessments, audits, and vulnerability scans
• Provide support investigations into cybersecurity incidents
• Coordinate with internal and external teams to resolve incidents in line with policy
• Recommend and implement technical solutions to mitigate identified risks

Security Services and Technical Oversight

• Oversee services such as:
• Vulnerability Management as a Service (VMaaS)
• Attack Surface Management (ASM)
• Penetration testing
• User security awareness training
• Participate in the design of secure infrastructure and application solutions

Stakeholder Engagement and Training

• Deliver security awareness training and track participation
• Respond to security inquiries from agencies and subscribers
• Build trusted relationships with our subscribers and partners

Who are the customers?

The State Chief Information Security Officer, State of New Mexico agencies, K-12 public school districts, higher educational institutions, local governments, and tribal entities.

Bachelor’s degree in Computer Science, Management Information Systems (MIS), Information Technology, Engineering, or similar technical degree and two (2) years of experience in IT security or compliance validation (e.g., HIPAA, PCI). Any combination of education from an accredited college or university in a related field and/or direct experience in this occupation totaling six (6) years may substitute for the required education and experience. A certificate in IT security/forensics (e.g., CISSP, CEH, CCFP, CCSP, HCISPP, SSCP) or regulated compliance (e.g., PCIP, ASV, ISA, QSA) can be used to substitute one (1) year of experience. Employment Requirements

Must possess and maintain current ID or Driver’s License. Pre-employment background investigation is required, and employment is conditional pending results. Working Conditions

The role is primarily office-based and involves extensive computer and phone use. The candidate should be comfortable working at a desk for extended periods and proficient with standard computer equipment (keyboard, mouse, display). Responsibilities include direct client interaction, attending meetings, and occasional travel. Physical requirements include the ability to lift up to 25 lbs and perform basic movements such as sitting, standing, bending, and reaching. Supplemental Information