TXCC - SOC Cybersecurity Engineer (Cybersecurity Analyst II-V)

Agency Information

The Texas Cyber Command (TXCC) is the states front line of cyber defense, established by the 89th Texas Legislature to protect Texans, critical infrastructure, and government systems from evolving cyber threats. Headquartered in San Antonio (a national hub of cybersecurity talent), TXCC unites threat detection, incident response, and statewide cyber readiness under one mission-driven agency to establish Texas as the most cyber-resilient state in the nation. At TXCC, your work doesnt just sit in a queue - it actively secures, protects, defends, and educates over 31 million Texans every day.

Job Description

Performs complex to highly advanced cybersecurity analysis and engineering work within the Texas Cyber Command (TXCC) Unified Cyber Task Forces (UCTF) Security Operations Center (SOC). Designs, configures, integrates, automates, secures, and maintains cybersecurity platforms and services supporting threat detection, investigation, and incident response for state agencies and other participating entities. Performs engineering activities involving security monitoring, telemetry management, detection capabilities, automation, system integrations, and operational reliability. Collaborates with cybersecurity operations, incident response, digital forensics, threat intelligence, and other internal and external partners to maintain and improve cybersecurity capabilities.

Works under the direction of the SOC Director, with varying degrees of supervision and latitude for initiative and independent judgment based on classification level. Assignments may emphasize platform and telemetry engineering, detection and automation, or exposure and service assurance, with responsibilities varying according to operational needs and technical specialization. Performs work within established authority, applicable laws, approved agreements, and organizational policies and procedures.

Essential Job Duties

• Configures, administers, secures, maintains, and improves cybersecurity platforms and supporting infrastructure, including security monitoring, endpoint protection, network security, cloud security, threat intelligence, automation, and case-management technologies. Identifies and resolves technical issues to maintain reliable security operations.
• Designs, implements, and maintains security telemetry collection, integration, processing, and enrichment capabilities. Onboards and validates data sources, monitors data quality and availability, and troubleshoots collection failures, data loss, and integration issues to support effective detection and investigation.
• Develops, tests, implements, and maintains scripts, application programming interface (API) integrations, and automated workflows supporting cybersecurity operations. Automates data enrichment, investigative processes, reporting, information exchange, and authorized response activities while maintaining appropriate security and operational controls.
• Develops, implements, tests, and improves security detection rules, investigative queries, correlation logic, and automated response capabilities. Incorporates threat intelligence, incident findings, and operational requirements to improve threat identification, detection accuracy, and response effectiveness.
• Monitors, evaluates, and improves the availability, performance, reliability, and resilience of cybersecurity platforms and services. Investigates system failures, identifies root causes, coordinates technical support, implements corrective actions, and maintains procedures supporting service restoration and operational continuity.
• Implements and maintains security configurations, access controls, authentication mechanisms, audit logging, and other protective measures for assigned cybersecurity platforms and services. Identifies and remediates vulnerabilities, misconfigurations, and security weaknesses in accordance with established requirements.
• Develops, tests, documents, and implements changes to cybersecurity platforms, configurations, code, detections, and integrations. Uses established change-management, version-control, testing, and deployment procedures to minimize operational disruption, validate results, and maintain system integrity.
• Integrates and analyzes asset, vulnerability, and exposure information to support cybersecurity monitoring, risk prioritization, remediation tracking, and operational reporting. Develops and improves processes, dashboards, and automated quality checks to evaluate security coverage and control effectiveness.
• Provides technical engineering and investigative support during cybersecurity incidents, including assistance with telemetry, queries, detection capabilities, automation, and platform troubleshooting. Collaborates with incident responders and other operational teams to analyze activity, identify technical limitations, and support authorized response activities.
• Evaluates cybersecurity technologies, system architectures, and operational requirements to recommend improvements in performance, capacity, security, resilience, maintainability, and cost-effectiveness. Maintains technical documentation, system diagrams, integration records, operational procedures, and other materials supporting cybersecurity services and assessments.
• Collaborates with internal teams, participating entities, vendors, and other partners to coordinate technical activities, resolve operational issues, and improve cybersecurity capabilities. Participates in training, exercises, assigned on-call support, and operational-readiness activities; provides technical guidance and knowledge sharing; and performs other work-related duties as assigned.

Qualifications

Must meet applicable U.S. citizenship requirements, successfully complete required background screening, and maintain eligibility to access the systems, facilities, and information necessary to perform assigned duties. Must successfully complete and maintain applicable operational-readiness, incident-management, and other required training within established timeframes.

Minimum Qualifications

Education:

Cybersecurity Analyst II: Graduation from an accredited college or university with an associate degree.

Cybersecurity Analyst III, IV, or V: Graduation from an accredited college or university with a bachelors degree.

Experience:

Cybersecurity Analyst II:

Two years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including hands-on experience in cybersecurity engineering, security platform administration, systems integration, detection engineering, or security automation.

Cybersecurity Analyst III:

Four years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including at least two years of hands-on experience in cybersecurity engineering, security platform administration, telemetry engineering, detection engineering, security automation, or cybersecurity systems integration.

Cybersecurity Analyst IV:

Seven years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including at least three years of hands-on cybersecurity engineering experience.

At least one year of experience leading technical engineering projects, coordinating complex system implementations, or directing the technical work of others.

Cybersecurity Analyst V:

Ten years of progressively responsible experience in cybersecurity, information security, or a closely related technical field, including at least four years of hands-on cybersecurity engineering experience.

At least four years of experience providing technical leadership in cybersecurity engineering, security architecture, complex systems integration, or enterprise cybersecurity infrastructure, including responsibility for major technical implementations or cross-platform engineering initiatives.

Note:

Required hands-on technical experience and technical leadership experience may overlap with the total years of professional experience required for the applicable classification level.

Experience used as a substitution for formal education must be additional to the required professional experience and may not be counted twice.

Additional Experience Required for All Levels:

Experience developing, testing, and troubleshooting scripts or code for cybersecurity automation, and independently writing and validating queries that retrieve and analyze security or operational data.

Experience configuring, integrating, troubleshooting, or maintaining cybersecurity technologies and supporting technical infrastructure.

Experience implementing technical solutions to meet operational or security requirements, including evaluating system dependencies, testing functionality, troubleshooting failures, and documenting results.

Licensure:

Cybersecurity Analyst II: One foundational cybersecurity certification.

Cybersecurity Analyst III: One foundational and one intermediate cybersecurity certification.

Cybersecurity Analyst IV: One foundational and one advanced practitioner cybersecurity certification.

Cybersecurity Analyst V: One of the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Advanced Security Practitioner (ICASP) or Certified in Risk and Information Systems Control (CRISC).

Qualifying certifications include:

Foundational: CompTIA Security+, GIAC Security Essentials (GSEC), or Systems Security Certified Practitioner (SSCP).

Intermediate: CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Forensic Examiner (GCFE), or CompTIA PenTest+.

Advanced Practitioner: GCIH, GCIA, GCFA, GCDA, GDAT, GREM, GPEN, GWAPT, GNFA, GMON, CEH, CASP+, CSAP, CCSP, APIPen, or OSCP.

Acceptable Substitutions

Additional related work experience may be used to substitute the formal education requirement on a year-for-year basis. Candidates must possess a high school diploma or equivalent certificate.

Experience used as a substitution for formal education must be additional to the required professional experience and may not be counted twice.

Preferred Qualifications

Experience:

Experience engineering or administering enterprise security information and event management (SIEM), endpoint security, network monitoring, cloud security, or cybersecurity automation platforms.

Experience with Google SecOps, including the Unified Data Model (UDM), YARA-L 2.0, data-source integration, parser validation, or detection engineering.

Experience with Cyware, Corelight/Zeek, SentinelOne, CrowdStrike, Microsoft Defender, Palo Alto, or comparable cybersecurity technologies.

Experience developing or maintaining API integrations, infrastructure as code, continuous integration and deployment processes, automated detection content, or scalable security telemetry solutions.

Experience supporting cybersecurity operations across multiple organizations, government entities, critical infrastructure, or managed security environments.

Experience improving cybersecurity service reliability, detection coverage, operational efficiency, or automated security processes.

Additional professional certifications or advanced technical training relevant to cybersecurity engineering, security architecture, cloud technologies, detection engineering, or automation.

Knowledge/Skills/Abilities

Knowledge of:

• Cybersecurity principles, practices, standards, controls, and applicable laws, policies, and procedures.
• Computer operating systems, enterprise networks, cloud environments, identity and access management, and associated cybersecurity technologies.
• Security information and event management (SIEM), endpoint detection and response (EDR), network security, threat intelligence, security automation, and related cybersecurity platforms.
• Cybersecurity engineering principles, including system integration, application programming interfaces (APIs), scripting, structured data, authentication, secure configurations, and version control.
• Security telemetry collection, data processing, normalization, enrichment, detection engineering, and automated response workflows.
• System architecture, software development practices, change management, access controls, vulnerability management, and cybersecurity service reliability.
• Cybersecurity threats, vulnerabilities, adversary tactics and techniques, incident response processes, and methods for evaluating security detection and control effectiveness.

Skill in:

• Configuring, integrating, administering, troubleshooting, and maintaining cybersecurity platforms, systems, and supporting infrastructure.
• Developing, modifying, testing, and troubleshooting scripts and automated workflows using programming or scripting languages such as Python, PowerShell, Bash, or comparable languages.
• Developing and validating investigative queries using relevant query languages, such as YARA-L 2.0, Kusto Query Language (KQL), Search Processing Language (SPL), Elastic query languages, or Structured Query Language (SQL).
• Developing, testing, implementing, and improving security detections, correlation rules, automated response workflows, and related cybersecurity capabilities.
• Integrating systems and exchanging information using APIs, structured data formats, command-line tools, and other technical integration methods.
• Analyzing system performance, telemetry quality, security events, and technical failures to identify root causes, evaluate potential solutions, and implement corrective actions.
• Applying secure configuration, access management, version control, testing, deployment, and change-management practices to cybersecurity systems and services.
• Evaluating technical requirements, system dependencies, operational risks, and potential impacts when designing or modifying cybersecurity solutions.
• Using electronic work-tracking systems, secure collaboration tools, and standard office productivity software to maintain technical documentation, prepare reports, and communicate engineering activities.
• Communicating complex technical information, operational risks, and recommended solutions clearly and effectively to technical and nontechnical audiences.

Ability to:

• Exercise sound technical judgment, take appropriate initiative, and make informed decisions when addressing complex cybersecurity engineering and operational challenges.
• Work independently within established authority while recognizing when additional expertise, resources, or escalation is necessary.
• Analyze unfamiliar technical environments, troubleshoot complex systems, and develop effective, maintainable solutions to operational problems.
• Evaluate the effects of technical changes on system security, performance, reliability, and interconnected services.
• Manage competing technical priorities, respond effectively to operational disruptions, and adapt to changing requirements and emerging cybersecurity threats.
• Maintain accountability for assigned systems and deliverables, communicate risks or errors promptly, and follow corrective actions through completion.
• Collaborate effectively with multidisciplinary teams, participating entities, vendors, and other stakeholders to implement and maintain cybersecurity capabilities.
• Protect confidential and sensitive information and maintain the security and integrity of cybersecurity platforms, technical records, and operational data.
• Learn and apply emerging technologies, engineering practices, and cybersecurity tools in support of organizational needs.
• Provide technical guidance, share knowledge, evaluate the work of others, and contribute to improvements in engineering practices and operational readiness.

Working Conditions

Work is performed in office, remote, and authorized field environments and involves prolonged computer use, configuration and testing of cybersecurity technologies, analysis of sensitive operational information, and collaboration with multidisciplinary teams and external partners.

Requires participation in assigned on-call coverage and availability to provide after-hours technical support for cybersecurity incidents, platform failures, critical system changes, exercises, or continuity operations. May require extended work hours, including evenings, weekends, and holidays, during operational disruptions, maintenance activities, or periods of increased demand.

Requires occasional travel, including on short notice, to support technical deployments, partner coordination, training, or other assigned activities.

Must maintain regular and punctual attendance, safeguard confidential and sensitive information, and comply with applicable security and professional certification requirements.

Military/Veteran Information

Military Occupation Specialty Code

The Military Occupation Specialty Codes applicable to this position can be found at this link.

Selective Service Registration

Section 651.005 of the Government Code requires males, ages 18 through 25 years, to provide proof of their Selective Service registration or proof of their exemption from the requirement as a condition of state employment.

Additional Information

H-1B Visa Sponsorship

We are unable to sponsor or take over sponsorship of an employment visa. Texas Cyber Command employees must be a citizen of the United States.

Equal Opportunity Employer

Texas Cyber Command does not exclude anyone from consideration for recruitment, selection, appointment, training, promotion, retention, or any other personnel action, or deny any benefits or participation in programs or activities, which it sponsors on the grounds of race, color, national origin, sex, religion, age, or disability. Please call 512-463-5920 to request reasonable accommodation.

How to Apply

Application Requirements

Every application must reflect a full employment history for each job held. You may provide this either directly in the Work History section of your application or as an attached résumé, but either way, each position listed must include:

• Job title
• Name of employer
• Employment start and end dates (month and year)
• A summary of the duties and responsibilities you held

If a listed position was part-time, please note that in the work history section or on your résumé.

Applicants must also answer the supplemental questions in the job application. Applications missing this information may be treated as incomplete and will not move forward in the review process.

Additional Application Information

• Fields that dont apply to you should be marked "N/A."
• If youre relying on education (rather than experience) to meet the minimum qualifications for this position, please attach a copy of your college transcript to your application.
• Leaving out required information could result in your application being disqualified from consideration.

Applying Through Work In Texas (WIT)

If youre applying via Work In Texas, youll also need to complete the set of supplemental questions before your application can be considered. These questions are only in CAPPS Recruit, so youll need to register for or sign in to your candidate profile: Access CAPPS Candidate Gateway

Need some help putting together a résumé? Work In Texas offers a "Create a Résumé" tool for job seekers on their website.

Contact Information

If you have any questions, please reach out to TXCC Human Resources at careers@txcc.texas.gov.