Office of the
Illinois Attorney General
Kwame Raoul

SUMMARY OF DUTIES AND RESPONSIBILITIES:

Under the direction of the Chief Information Security Officer (CISO), the Senior Cybersecurity Operations Analyst will be responsible for analyzing events from multiple security tools to identify incidents and potential information security threats to the organization. The Senior Cybersecurity Operations Analyst will conduct comprehensive and detailed analysis of network and endpoint events, to quickly determine the source and severity, and to advise on the most effective and efficient way to triage the event.

The Senior Cybersecurity Operations Analyst will identify, corelate, escalate, and respond to security incidents using various security technologies and incident response methodologies. They will act as the lead incident response handler, coordinate the response efforts, and provide recommendations on security controls, tools, and processes to prevent future incidents. The Senior Cybersecurity Operations Analyst will provide detailed reports to the CISO and/or other team members about the root cause of an incident and recommended follow-up actions. Additionally, they will develop, enhance, and maintain incident response documentation such as incident response plans, procedures, and guidelines.

The Senior Cybersecurity Operations Analyst will stay current with emerging security threats and vulnerabilities, proactively identify potential information security risks to the organization, and participate in incident response testing and tabletop exercises to ensure the organization is prepared to handle potential information security incidents.

MINIMUM QUALITIFCATIONS:

This position requires a bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field, and a minimum of 5 years work experience in network security, incident response, or incident investigation. Experience in conducting forensic analysis and digital investigations as part of an incident response team, along with strong knowledge of network security concepts and technologies, including intrusion detection/prevention, firewalls, and SIEM technologies are highly preferred. Relevant industry certifications such as GCFA, GCIH, CISA, CISSP are a plus.

Ability to effectively coordinate, problem solve, prioritize, and collaborate along with outstanding written and verbal communication skills. Attendance and the ability to maintain satisfactory working relationships with OAG employees and the general public is required.

HOURS OF WORK:     9:00 a.m. – 5:00 p.m. (Monday - Friday)