> Markdown version of [/jobs/ext/685599-cyber-security-lead-analyst-whole-of-state](https://www.wearedevelopers.com/jobs/ext/685599-cyber-security-lead-analyst-whole-of-state). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Security Lead Analyst (Whole of State) - **Company:** The State Of Colorado - **Location:** Lakewood, CO, United States - **Experience:** Expert - **Salary:** $72,264.0 - $90,000.0 - **Contract:** Permanent contract - **Skills:** Data Analysis, Software System Penetration Testing, ArcGIS (Software), Cloud Computing Security, CompTIA Security+, Cyber Security, Databases, Data Cleansing, Decision Support Systems, Intelligence Analysis, Python (Programming Language), Network Security, Automation of Marketing, Open Source Technology, Open Source Intelligence, Systems Integration, Information Technology, Cybercrime, Data Analytics - **Published:** June 28, 2026 - **Apply:** https://www.juju.com/job/00000000gbuxea ## About the Role Note, to be considered for this position, you must meet one of the following options for consideration. Proven Experience, Knowledge, Skills Seven (7) years of demonstrated full-time professional experience in cybersecurity or information technology. OR Education and Experience, Knowledge, Skills Bachelor's degree from an accredited institution in or a closely related field and three ( 3 ) years demonstrated professional experience in c ybersecurity or information technology. OR Master's degree from an accredited institution in or a closely related field and one( 1 ) years demonstrated professional experience in c ybersecurity, or information technology. Experience must include the following: + Intelligence Analysis and Synthesis: Ability to collect, analyze, and synthesize complex cyber threat data from diverse sources (OSINT, classified, technical) into clear, actionable intelligence products. + Information Sharing and Outreach: Ability to build and maintain relationships with diverse stakeholders, including state/local/tribal/territorial (SLTT) partners, federal agencies, and the private sector, to foster a collaborative information-sharing environment. + Incident Response Acumen: Foundational knowledge of cyber incident response principles, including containment, evidence collection, analysis, and coordination with technical teams. + Communication and Briefing Skills: Superior written and verbal communication skills, with the capacity to deliver high-stakes, professional, and often Classified briefings to both technical and executive-level audiences. + Programmatic Support: Experience in supporting or managing elements of a large-scale cybersecurity program, including developing program maturity, conducting assessments, and organizing training/exercises (TTXs). + NIMS/ICS Familiarity: Working knowledge of the National Incident Management System (NIMS) and Incident Command System (ICS) for supporting State Emergency Operations Center (SEOC) functions during critical events. + Ethics and Compliance: Deep commitment to protecting privacy, civil rights, and civil liberties while performing intelligence duties. Preferred Qualifications + Cybersecurity Certifications (Comp TIA Security+, ITIL, Network+, CEH, CISSP, SANS GCIH, or equivalent) + Experience working with cybersecurity issues in the State, Local, Tribal sector or critical infrastructure sectors + Experience applying threat modeling frameworks or methodologies + Experience with foundational understanding of cloud computing security principles + Strong, technical understanding of the threat scape and associated prevention, protection, mitigation, response and recovery activities. + Understanding of industry-recognized threat- security tools and techniques for network defense, forensics, penetration testing, and threat mitigation. + Excellent oral and written communications skills. + Knowledge of critical infrastructure protection policy and related critical infrastructure protection concepts, principles, and practices. + Documented skill set with spoken and written communications and presentation graphics. + Skills in the use of ArcGIS Pro and Python with basic understanding of Data cleaning processes. + Experience aligning team-level objectives with overarching organizational strategy. + Experience mentoring, coaching, and developing team members to achieve operational goals. Conditions of Employment + Requires successful completion of a background investigation that includes a polygraph exam, a fingerprint based criminal history search, reference check . + Must be a Colorado resident at the time of application + Must obtain and maintain a SECRET security clearance issued by the Department of Homeland Security (DHS) within 9 (nine) months of hire + Must be certified to administer, view and share Protected Critical Infrastructure Information (PCII) within six (6) months of hire. + On-call- must be able to respond to emerging incidents with little to no warning and which may occur outside normal business hours. ## Description The All Threats Intelligence Unit is responsible for the collection, analysis and dissemination of all threat information for the purpose of information sharing on criminal activities and terrorism-related threats affecting Colorado. The Center collaborates with private sector, local, tribal and federal partners to support, prevent, and protect Colorado and its citizens. The infrastructure protection and cyber-security programs promote greater resiliency of government, non-government, and private-sector facilities, systems, assets, and employees through an array of prevention, protection, mitigation, response and recovery strategies designed to deter, delay, detect and defend against human threats and technological hazards, while reducing the impact of natural hazards. The programs also provide a range of technical assistance to enhance their security posture and preparedness against all-hazards. Through the development and maintaining of public-private partnerships and ongoing support of state government agencies, the program aims to expand information sharing opportunities, enhance data collection and threat reporting to produce actionable intelligence, provide training and awareness, and adopt a layered, defense-in-depth strategy to assure the resiliency of Colorado communities and Colorado state government infrastructure. Under the CIAC's Infrastructure Protection program, The Whole of State initiative for critical infrastructure allows the State of Colorado to actively maintain an inventory of critical infrastructure nodes and facilities in the state, and maintain a database of this inventory that is utilized by numerous emergency management officials during significant emergency events. Cybersecurity analysts support Colorado's Whole of State cybersecurity effort to make Colorado the most resilient state against cyber-attacks across several areas of focus. Specifically, the Cyber Team works to identify and investigate emergency threats and vulnerabilities to the SLTT, critical infrastructure and private sector communities; provides timely, accurate, and actionable information; supports the sharing of best practices within and between sectors with regards to enhancing cyber protections; and offers technical assistance and coordination support specific to cyber assessment support, incident response support, and cyber program maturity growth. Work Environment + Monday through Friday between core hours of 7:00 a.m. to 5:00 p.m. + A hybrid work model is utilized, requiring in-office attendance a minimum of three (3) days per week. About the Job This critical position is responsible for providing high-level cyber intelligence, data analytics, and programmatic support to the Colorado Bureau of Investigation (CBI) Cyber-Security Unit; the Colorado Information Analysis Center (CIAC); various infrastructure sectors including energy, water & wastewater, communications, and information technology; and other key stakeholders. The position establishes intelligence collection and production requirements related to cyber-security prevention, protection, and mitigation, and provides real-time response capability during significant cyber-security events. The position assists with recovery efforts to promote rapid restoration of systems and networks. The position requires writing a variety of analytical products that enhance education and awareness and provide decision support to DHSEM leadership and other key stakeholders. The Lead Analyst will play a pivotal role in supporting the development of Colorado's Whole of State Cybersecurity Program, dedicated to empowering Colorado's communities to become the most resilient state in the U.S. against cyber threats. As part of the Whole of State's Cybersecurity Unit, the Analyst will be responsible for providing actionable information with federal, SLTT, critical infrastructure and community partners, and technical assistance support and coordination. As a Lead Analyst and Work Lead, this staff member must demonstrate strong leadership and must serve as a role model, coordinate and communicate with supervisors, and maintain the highest level of professional expertise. This position plans, organizes, and directs overall workplace functions, coordinating time and multiple schedules for maximum staff coverage and efficiency of operation. Key Responsibilities Whole of State Cyber Security Lead + Leading the identification, investigation, and analysis of cybersecurity threat intelligence from a variety of open-source and Classified sources. + Responsible for writing analytical products, developing regular, timely briefs, and helping other analysts in their production as well, for a variety of customers. + Leads long-term analytical and investigative projects related to cybersecurity prevention, protection, mitigation, response and recovery activities. + Delivers briefings (including Classified) on ongoing cybersecurity threats to internal and external audiences, including helping to prepare Classified briefings for leadership and Fusion Center partners. + Develops and maintains information sharing channels throughout the State and with other partners, and maintains security protocols of those channels. + Formulates and individualizes analytical processes to evaluate complex, multi-sector datasets where no precedent exists. Applies advanced professional judgment to develop methodologies that identify cascading effects, threat interdependencies, and resilience gaps. + Provides authoritative consultation to division and department management on analytic policy, data-governance standards, and enterprise-system integration strategies. Produces finished intelligence products, vulnerability analyses, and technical assessments accepted on technical merit as the basis for agency program and policy decisions. + This position performs more complex activities and tasks as they relate to the Cyber Whole of State Program. + Oversees the technical integration of WoSCI capabilities and datasets into DHSEM's ArcGIS Enterprise. + Works closely with the WOS Infrastructure Protection Lead Analyst, Cyber Analysts and Supervisor as well as the GIS Analysts on Whole of State Initiatives and Management of the Enterprise. + Display a high degree of independent initiative, discretion, and sound judgment, as well as the ability to integrate organizational priorities, meeting deadlines and deliver results. + Makes informed decisions that uphold CIAC goals and risk management protocols, while proactively supporting leadership in executing strategic initiatives and maximizing team efficiency. Cyber Outreach and Support + Develop and maintain robust partnerships with Colorado's SLTT community, federal partners, and critical infrastructure/private sector partners to expand information sharing outreach. + Share best practices within and between key sectors and communities to advance Colorado's overall cybersecurity posture. + Coordinate and lead tabletop exercises (TTXs) and trainings for internal and external partners across Colorado and with other state partners to support greater information sharing and threat readiness. + Provide technical assistance across a variety of fronts including the development of incident response plans, business continuity planning, cyber assessments and cyber program maturing to the nine all-hazards regions. + Identifies new partner and outreach opportunities for the Cyber Unit; supports ongoing information campaigns around the Colorado Whole of State Program and its offerings. + This position understands the full scope of a fusion center so as to support the private sector, local, state, tribal, and federal partners of the CIAC to assist the Center in meeting the Center's mission. + Utilizing professional judgement and advanced analytical skills, this position will communicate with leadership and potentially partners on the research methodology employed and the analytic observations of information assessed. + Set up databases to ensure proper analysis can occur to achieve the desired outcome using known analytical techniques, professional judgement, and resourcefulness to develop the correct approach for each project. Cyber Incident Response Support + Assist with incident response handling (not to include recovery) in coordination with OIT, the Colorado National Guard, MS-ISAC, and federal partners, focusing on containment and analysis. + Help guide the containment of the threat. + Collect and analyze evidence related to a threat or attack, and work to share out lessons learned and best practices from the incident to strengthen other potential targets. + Develops and coordinates broader cyber incident response support across Colorado. + Leverages existing Threat Liaison Officer (TLO) network to enhance cyber preparedness and incident response support throughout the state. + Serve as a member of the CIAC leadership team by reviewing and approving products prior to dissemination. + Possess excellent communication and interpersonal skills, demonstrating tact and diplomacy to consistently interact effectively and with flexibility with diverse groups of people. + Submits necessary reports that are complete, accurate, appropriate and timely. + Collects factual information in order to facilitate the appropriate response from customers. + When receiving a complaint, investigate and address issues necessary for dissemination to proper authority for timely disposition of complaint. + Assists law enforcement and criminal justice agencies. + Performs other duties as assigned. State Emergency Operations Center Support/Other Duties as Assigned + Responsible for protecting privacy, civil rights and civil liberties pursuant to law or policy. + Supports Fusion Center operations during critical, human-caused cyber-related events. + Supports the activation of the State Emergency Operations Center (SEOC) during exercises or actual events in accordance with NIMS/ICS guidelines. + Performs duties as assigned within the CIAC, under the immediate direction of the CIAC Cyber Security/Critical Infrastructure Whole of State Program Supervisor and SEOC Manager. + Coordinates with emergency support function #2, Communications, to support response efforts following a major disaster, emergency, or extraordinary situation. As part of SEOC advise on technical issues related to the procurement of skilled technical personnel and equipment from the private sector to support resource requests. + Performs other duties as assigned in the SEOC. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Data Science in Retail](https://www.wearedevelopers.com/videos/586-data-science-in-retail) - [Kubernetes and Microservices with Multi-Model Databases](https://www.wearedevelopers.com/videos/382-kubernetes-and-microservices-with-multi-model-databases) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Data Science on Software Data](https://www.wearedevelopers.com/videos/162-data-science-on-software-data) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [7 Important Tips That Every Software Developer Should Know](https://www.wearedevelopers.com/magazine/101-7-important-tips-that-every-software-developer-should-know) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Best Coding Boot Camps in Germany](https://www.wearedevelopers.com/magazine/237-best-coding-boot-camps-in-germany)