Enterprise Principal Technology Analyst (Cybersecurity Operations Manager)

Enterprise Principal Technology Analyst (Cybersecurity Operations Manager)

Salary

$163,035.60 - $198,525.60 Annually

Location

San Jose

Job Type

Full-Time

Job Number

202601781

DEPART

Information Technology

Opening Date

09/14/2026

Closing Date

Continuous

• Description
• Benefits
• Questions

Our diverse and inclusive workforce of more than 7,000 employees play a key role in the success of San José, the heart of the Silicon Valley. All City of San José employees work together as one team to make San José a vibrant, innovative, and desirable place to live and work. Visit here to learn more about our One Team Leadership Values and Expectations, including quality and excellent customer service and here to learn more about San José.

The City of San José is an equal opportunity employer. Applicants for all job openings will be considered without regard to age, race, color, religion, sex, national origin, sexual orientation, disability, veteran status or any other consideration made unlawful under any federal, state or local laws. The City of San José is committed to offering reasonable accommodations to job applicants with disabilities. If you need assistance or an accommodation due to a disability, please contact us at 408-535-1285, 711 (TTY), or via email at CityCareers@sanjoseca.gov.

About the Department

The City of San José innovates to provide exceptional civic services using advanced technologies to help our community thrive.

As one of the largest cities in the nation, the City manages a large set of services and assets and operates on a budget of $6.2 billion, with approximately 7,000 employees, serving about 1 million residents and 80,000 businesses in the heart of Silicon Valley.

The Information Technology Department's (ITD) mission is to enrich the quality of life in San José through innovation, collaboration, and engagement. ITD enables that mission through business and infrastructure systems, cybersecurity, data management and analysis, responsible use of Artificial Intelligence (AI), productivity and collaboration tools, the San José 311 resident experience platform, data equity and privacy programs, and strategic planning. San José is powered by truly great people, a robust technology environment, and a strong sense of purpose.

The IT department is a leader in innovation, embracing cutting-edge technologies and pioneering solutions to enhance efficiency and quality of life in San José. As part of this effort, the City leads a national initiative for AI through the GovAI Coalition, which was established to give local governments a voice in shaping the future of AI, ensuring it is developed responsibly and for the public good.

Promoting the City's commitment to equity and inclusion, we believe that all members of the community, regardless of background, have access to the tools and resources needed to thrive in the digital age. San José is in the heart of Silicon Valley, which boasts a rich history in technology, education, and agriculture. Over half of San José residents speak a language other than English at home, highlighting the importance of language accessibility in all City services. By fostering inclusivity, promoting digital literacy, and building accessible platforms, we are advancing technology while creating a more equitable future for everyone.

At the City of San José, we promote work-life alignment and a focus on growth to bring out the best in our people. Come join us in making San José the most vibrant, equitable, sustainable, and innovative city in the nation! Visit the Information Technology Department's website to learn about our culture, vision, leadership, and innovative initiatives.

Position Duties

NOTE - The first review of applications will be on September 28,2026. Please submit your application by 11:59 p.m. (PST), if you would like your application to be included in the first review.

This is a highly technical, hands-on leadership role responsible for managing a small team that protects the organization from cyber threats through cyber-threat intelligence, cybersecurity emergency response, security engineering, threat detection, and defensive security architecture.

This position requires a technically credible leader who can both manage people and directly contribute to complex cybersecurity engineering, design, configuration and implementation. The successful candidate must have expert-level technical and operational knowledge of enterprise security operations, network security, endpoint security, identity security, cloud security, security monitoring, incident response, threat hunting, and defensive architecture. This is not a purely administrative management position; the Cybersecurity Operations Manager must be capable of providing direct technical contributions, provide guidance, make sound risk-based decisions under pressure, and actively participating in complex investigations, engineering efforts, architecture reviews, detection improvements, and operational response activities.

The role is responsible for ensuring that cybersecurity tools, processes, controls, and response capabilities are effective, integrated, measurable, and aligned with organizational risk, operational priorities, and cybersecurity best practices. The ideal candidate will lead by example, set clear technical and operational expectations, improve the maturity of the security operations function, and partner closely with infrastructure, network, endpoint, cloud, application, identity, and business teams to reduce risk across the enterprise.

The ideal candidate is a strong technical leader who can operate at both the strategic and tactical levels; translating cyber threats into actionable defenses, guiding the team through high-pressure incidents, strengthening the organization's defensive posture, and continuously improve the organization's ability to prevent, detect, respond to, and recover from cyber threats.

Key duties include but are not limited to:

• Provide hands-on technical leadership, mentoring, prioritization, and quality assurance while coordinating with infrastructure, network, endpoint, cloud, application, identity, and service desk teams to reduce enterprise cybersecurity risk.
• Lead the collection, analysis, and operational use of cyber-threat intelligence to identify emerging threats, vulnerabilities, attacker techniques, and indicators of compromise.
• Translate intelligence into actionable defenses, including detections, hunting queries, blocking rules, advisories, and risk-based recommendations that support incident response, vulnerability management, security engineering, and leadership reporting.
• Lead cybersecurity emergency response for suspected or confirmed security incidents, including triage, containment, eradication, recovery, root-cause analysis, and post-incident improvement.
• Provide technical direction during high-pressure events involving phishing, malware, credential compromise, unauthorized access, data exposure, endpoint compromise, cloud compromise, network intrusion, or advanced threats.
• Build and maintain security operations standards, process flows, incident response playbooks, escalation procedures, evidence-handling practices, and clear incident documentation.
• Lead cybersecurity projects and operational initiatives by defining scope, milestones, deliverables, dependencies, risks, and success criteria; coordinating cross-functional technical teams, vendors, and stakeholders; tracking progress; resolving blockers; communicating status; and ensuring timely delivery of measurable security and operational outcomes.
• Lead the design, implementation, tuning, and continuous improvement of enterprise security controls across network, endpoint, cloud, identity, email, data protection, remote access, logging, monitoring, and automation environments.
• Ensure security tools are properly configured, integrated, monitored, and producing actionable outcomes. Partner with technical teams to review proposed changes, identify risks, recommend compensating controls, and embed security into enterprise solutions.
• Oversee the development, validation, tuning, and continuous improvement of detection logic across SIEM, EDR/XDR, network, identity, cloud, and email security platforms. Lead threat-hunting activities to identify suspicious behavior, control gaps, misconfigurations, compromised accounts, lateral movement, persistence, and other indicators of attacker activity. Improve detection coverage, reduce false positives, and measure operational effectiveness.
• Independently lead comprehensive cybersecurity risk reviews of complex technology implementations, including out-of-the-box vendor solutions, cloud platforms, SaaS applications, infrastructure services, endpoint tools, network technologies, IoT systems, and desktop environments. Evaluate default configurations, architecture decisions, access models, logging, data protection, integration points, and operational impacts; identifies security gaps and risk exposure; and develops practical risk-reduction strategies, compensating controls, secure configuration requirements, and implementation guidance to ensure solutions are securely deployed and operated.
• Support audit, compliance, and risk-management activities with technical evidence, control validation, and remediation support.

The successful candidate must demonstrate strong technical expertise and experience in the following areas:

• Network security, including firewalls, segmentation, routing, VPN, DNS, web filtering, secure remote access, and network traffic analysis.
• Endpoint security, including EDR/XDR, malware analysis concepts, host-based investigation, endpoint hardening, and containment strategies.
• Identity security, including Active Directory, Entra ID/Azure AD, MFA, privileged access, conditional access, account compromise investigation, and identity-based attack paths.
• Cloud security, including cloud logging, identity integration, access control, workload protection, SaaS security, and cloud misconfiguration risk.
• Security monitoring, including SIEM use cases, detection logic, log source onboarding, alert tuning, threat hunting, and incident investigation.
• Incident response, including triage, containment, eradication, recovery, root-cause analysis, evidence preservation, and after-action reporting.
• Threat intelligence, including analysis of attacker behavior, indicators of compromise, tactics, techniques, procedures, and operationalizing intelligence into controls.
• Security architecture, including defense-in-depth, zero trust principles, least privilege, secure design reviews, compensating controls, and enterprise risk reduction.

Please note that the Cybersecurity Operations Manager position is currently eligible for a hybrid telework schedule. The schedule for working remotely and onsite is subject to change.

Salary Information: The final candidate's qualifications and experience shall determine the actual salary. In addition to the starting salary, employees in the Enterprise Principal Technology Analyst (EPTA) classification shall also receive an approximate five percent (5%) ongoing non-pensionable compensation pay.

• Salary Range $163,035.60 - $198,525.60

Minimum Qualifications

Education and Experience: A Bachelor's Degree from an accredited college or university in a relevant field AND five (5) years of increasingly responsible professional/ level experience in computer applications, systems, networks, or telecommunications work, of which at least two (2) years include responsibility in the development, implementation, and maintenance of electronic business systems/solutions, or application development and/or support.

Acceptable Substitution:

• Additional years of increasingly responsible directly related work experience may be substituted for education on a year-for-year basis up to two (2) years.
• Completion of a Masters Degree in a relevant field from an accredited college or university may be substituted for one year of the required two (2) years of experience in the development, implementation, and maintenance of electronic business systems/solutions, or application development and/or support.

Other Qualifications

The ideal candidate will possess the following competencies, as demonstrated in past and current employment history. Desirable competencies for this position include:

Job Expertise - Demonstrates knowledge of and experience with applicable professional/technical principles and practices, Citywide and departmental procedures/policies, and federal and state rules and regulations.

• Experience in public sector, critical infrastructure, large enterprise, healthcare, financial services, or other highly regulated environments.
• Demonstrated experience managing complex cybersecurity projects or operational initiatives involving cross-functional technical teams, vendors, and stakeholders, with responsibility for project planning, risk and dependency management, progress tracking, issue resolution, executive communication, and delivery of measurable security or operational improvements.
• Candidate must be able to evaluate, administer, tune, and integrate security tools to improve visibility, control effectiveness, and response capabilities.
• Experience with frameworks and standards such as NIST Cybersecurity Framework, NIST 800-53, CIS Controls, MITRE ATT&CK, CJIS, PCI DSS, or ISO 27001.
• Experience building or maturing a cybersecurity operations function.
• Demonstrated experience independently evaluating complex technology implementations for cybersecurity risk, including vendor-provided, out-of-the-box, cloud, SaaS, network, endpoint, server, IoT, and desktop solutions. This includes assessing architecture, identity and access controls, logging and monitoring, data protection, endpoint and network exposure, configuration baselines, integration risks, and operational dependencies; identifying gaps or misconfigurations; and developing risk-reduction methodologies, compensating controls, secure design recommendations, and implementation requirements to reduce enterprise risk

Leadership Skills - Leads by example; demonstrates high ethical standards; remains visible and approachable and interacts with others on a regular basis; promotes a cooperative work environment, allowing others to learn from mistakes; provides motivational supports and direction.

Analytical Thinking - Approaches a problem or situation by using a logical, systematic, sequential approach.

Building Trust - Communicates an understanding of the other persons interests, needs and concerns; identifies and communicates shared interests and goals; identifies and communicates differences as appropriate; demonstrates honesty, keeps commitments, and behaves in an appropriate manner.

Project Management - Ensures support for projects and implements agency goals and strategic objectives.

Vision/ Strategic Thinking - Supports, promotes, and ensures alignment with the organization's vision and values; understands how an organization must change in light of internal and external trends and influences; builds a shared vision with others and influences others to translate vision to action.

Problem Solving - Approaches a situation or problem by defining the problem or issue; determines the significance of problem; collects information; uses logic and intuition to arrive at decisions or solutions to problems that achieve the desired outcome.

Communication Skills - Effectively conveys information and expresses thoughts and facts clearly, orally and in writing; demonstrates effective use of listening skills; displays openness to other people's ideas and thoughts.

Multi-Tasking - Can handle multiple projects and responsibilities simultaneously; has handled a wide variety of assignments in past and/or current position(s).

Reliability - Completes quality work assignments in a timely and efficient manner; fulfills responsibilities and maintains confidentiality as appropriate.

Teamwork & Interpersonal Skills - Develops effective relationships with co-workers and supervisors by helping others accomplish tasks and using collaboration and conflict resolution skills.

The selection process will consist of an evaluation of the applicants training and experience based on the application and responses to all the job-specific questions. You must answer all questions to be considered, or your application may be deemed incomplete and withheld from further consideration. Only those candidates whose backgrounds best match the position will be invited to proceed in the selection process. Additional phases of the selection process will consist of one or more interviews, one of which may include a practical and/or writing exercise. If you have questions about the duties of these positions, the selection, or the hiring processes, please contact Jessica Delgado at Jessica.Delgado@sanjoseca.gov

Additional Information:

Employment Eligibility: Federal law requires all employees to provide verification of their eligibility to work in this country. Please be informed that the City of San Jose will NOT sponsor, represent or sign any documents related to visa applications/transfers for H1-B or any other type of visa which requires an employer application.

You must answer all job-specific questions to be considered for this vacancy or your application will be deemed incomplete and withheld from further consideration. Applicants are expected to write their own essays/responses.

Please note that applications are currently not accepted through CalOpps or any other third party job board application system.

This recruitment may be used to fill multiple positions in this, or other divisions or departments. If you are interested in employment in this classification, you should apply to ensure you are considered for additional opportunities that may utilize the applicants from this recruitment.

Please allow adequate time to complete the application and submit before the deadline or the system may not save your application. If your online application was successfully submitted, you will receive an automatic confirmation email to the email address you provided. IF YOU DO NOT RECEIVE THE CONFIRMATION, please email CityCareers@sanjoseca.gov and we will research the status of your application.

AI and the Hiring Process

We recognize that Artificial Intelligence (AI) is becoming part of daily life and can be a valuable tool for learning, research, and professional growth. We encourage candidates to use AI responsibly as a support in preparing application materials, live assessments, and interviews. However, we value authenticity, accuracy and truthfulness. Application responses and interview answers must reflect your own knowledge, skills, and experiences. While AI can supplement preparation, it cannot replace the originality and judgment we look for in our employees. This ensures fairness, transparency, and equity for all applicants in the hiring process.

The City of San Jose offers a wide range of core health benefits including Medical, Dental, Vision, Employee Assistance Program, Life Insurance, Disability, and Savings Plans. Please visit the Citys benefits page for detailed information on coverage, cost, and dependent coverage.

For information on the City's Retirement Plan(pension for full-time employees), please visit the Office of Retirement Services website. You will be able to view information based on different Sworn/Federated job classification.

In additional to the benefits above, there is an additional perks site to explore further benefits of working for the City of San Jose like paid leave, educational reimbursements, and holiday pay are specific to the job classification and union membership.

01

What is the highest level of education you have completed?

• High School Diploma or the equivalent (GED)
• College (1 to 29 semester units/ 1 to 44 quarter units)
• College (30 to 59 semester units/ 45 to 89 quarter units)
• College (60 to 89 semester units/ 90 to 134 quarter units)
• College (90 to 119 semester units/ 135 to 179 quarter units)
• College (120 or more semester units/ 180 or more quarter units)
• Associates Degree
• Bachelors Degree
• Masters Degree
• Doctoral Degree
• Other
• None of the above

02

If you have a Bachelors degree or higher from an accredited college or university in a related field, please state the field of study and the issuing accredited college or university.

03

How many years of experience do you have in computer applications, systems, networks, or telecommunications work?

• Fewer than five (5) years
• Five (5) years - Six (6) years
• Six (6) - Seven (7) years
• Seven (7) years or more

04

. Of the experience in the above question, how many years have included responsibility in the development, implementation, and maintenance of electronic business systems/solutions, or application development and/or support.

• Fewer than two (2) years
• Two (2) years or more

05

Provide an example of a significant cybersecurity incident you led, such as phishing, malware, credential compromise, unauthorized access, cloud compromise, endpoint compromise, or network intrusion. What specific role did you play? How did you handle triage, containment, eradication, recovery, documentation, and post-incident improvement?

06

Describe your experience administering, tuning, integrating, or improving cybersecurity tools such as SIEM, EDR/XDR, vulnerability management, threat intelligence, identity security, cloud security, email security, SASE/ZTNA, CASB, DLP, or PAM. What specific improvements did you make to visibility, detection quality, false positives, threat hunting, or response capability?

07

Describe a time when you inherited or led a highly technical cybersecurity team that needed stronger direction, better execution, or improved operational maturity. How did you assess the team's technical capabilities, set expectations, prioritize work, review the quality of technical output, mentor or correct underperformance, and measure improvement over time?

Required Question

Employer City of San Jose

Address 200 E Santa Clara St

San Jose, California, 95113

Phone (408) 535-1285

Website https://www.sanjoseca.gov/