Cybersecurity Operations Center Engineer

FALL CREEK FARM & NURSERY; Austin (TX); On-site; USD 78,000 - 132,000; Full time

Benefits offered by this job

100% paid employee health insurance

Defined benefit pension

Generous time off benefits

Job summary

The Texas Health and Human Services Commission (HHSC) is seeking a Cybersecurity Analyst III to join the Cybersecurity Operations Center team in Austin. This onsite role focuses on security engineering, monitoring, detection, and incident response across on-premises and cloud environments.

As a CSOC Engineer you will design and maintain SIEM/EDR/XDR, SOAR, and security integrations, develop detection content, automation, and governance with a strong emphasis on MITRE ATT&CK and NIST controls.

Qualifications

• Graduation from a four-year college or university strongly preferred.
• Experience in a Security Operations Center (SOC) and with SIEM platforms.
• Experience with security operations automation and incident response.

Responsibilities

• Design, implement, and maintain enterprise cybersecurity monitoring and incident response capabilities.
• Develop detections, correlations, dashboards, and threat-hunting content.
• Integrate security technologies across cloud, network, and endpoint environments.

Skills

SOC architecture

Security monitoring

Automation

Data analysis

Collaboration

Education

Bachelor's degree preferred

Tools

SIEM

SOAR

EDR/XDR

NDR

Splunk

Job description

Career Opportunities: Cybersecurity Operations Center Engineer (20366)

Posting ID20366-Posted08/20/2026-Health & Human Services Comm-CISO - DSHS 4.2.5-Computer and Mathematical- Additional Shifts available (1) -d. $7000 - $8999 per month

Join the Texas Health and Human Services Commission (HHSC) and be part of a team committed to creating a positive impact in the lives of fellow Texans. At HHSC, your contributions matter, and we support you at each stage of your life and work journey. Our comprehensive benefits package includes 100% paid employee health insurance for full-time eligible employees, a defined benefit pension plan, generous time off benefits, numerous opportunities for career advancement and more. Explore more details on the Benefits of Working at HHS webpage .

• Functional Title: Cybersecurity Operations Center Engineer
• Job Title: Cybersecurity Analyst III
• Agency: Health & Human Services Comm
• Department: CISO - DSHS 4.2.5
• Posting Number: 20366
• Closing Date: 10/19/2026
• Posting Audience: Internal and External
• Occupational Category: Computer and Mathematical
• Salary Range: $7,015.16-$11,864.50
• Pay Frequency: Monthly
• Salary Group: TEXAS-B-27
• Shift: Day
• Additional Shift: Days (First)
• Telework:
• Travel:
• Regular/Temporary: Regular
• Full Time/Part Time: Full time
• FLSA Exempt/Non-Exempt: Exempt
• Facility Location:
• Job Location City: AUSTIN
• Job Location Address: 701 W 51ST ST
• Other Locations: None
• MOS Codes: 0605,0630,0631,0639,0670,0679,0681,1702,1705,1710,1720,1721,1799,2611,2659,8055,8858,14N,14NX,170A
  170B,17A,17B,17C,17C0,17DX,17S,17SX,17X,181X,182X,183X,184X,1B4X1,1D7X1,1N4X1,255A,255N,255S,25B,25D
  26A,26B,26Z,514A,5C0X1D,5C0X1N,5C0X1R,5C0X1S,5IX,681X,682X,683X,781X,782X,783X,784X,CTI,CTM,CTR,CWT
  CYB10,CYB11,CYB12,CYB13,CYB14,IS,ISM,ISS,IT,ITS

Brief Job Description

This position is open to U.S. Citizens and permanent residents.

This onsite role requires the selected candidate to work from an HHS office in Austin, Texas.

The Cybersecurity Analyst III performs senior-level cybersecurity engineering work with emphasis on security operations engineering, security platform administration, detection engineering, automation, orchestration, and cybersecurity infrastructure integration. The role supports agency on-premises and cloud environments by designing, implementing, maintaining, and enhancing security technologies used to protect agency systems, applications, hosts, networks, cloud services, and data. The Cybersecurity Analyst III also participates in incident response as needed.

The Cybersecurity Operations Center (CSOC) Engineer is responsible for engineering and maintaining the technical capabilities that enable enterprise security monitoring, threat detection, incident response, threat hunting, and cybersecurity operations. This position provides senior-level expertise in SIEM engineering, security orchestration and automation, cloud security integrations, endpoint security platforms, security monitoring architecture, and detection development.

The CSOC Engineer develops and maintains enterprise security monitoring infrastructure, enhances agency cybersecurity visibility, and implements technical solutions that improve the efficiency and effectiveness of security operations. This position serves as a critical technical resource responsible for ensuring security platforms generate reliable, actionable, and meaningful intelligence for cybersecurity analysts, engineers, and leadership.

This position performs highly complex information security and cybersecurity engineering work. The Engineer works under limited supervision with considerable latitude for the use of initiative and independent judgment. The Engineer will research, evaluate, implement, and optimize new security technologies, detection methodologies, automation capabilities, integrations, and operational solutions used to prevent, detect, contain, and respond to cybersecurity threats.

The Engineer provides expert guidance regarding cybersecurity technologies, monitoring architectures, logging standards, data onboarding strategies, security automation opportunities, and defensive engineering practices. This role partners closely with Cybersecurity Operations, Threat Hunting, Incident Response, Security Architecture, Infrastructure Services, Cloud Operations, and Application Development teams to strengthen the agency's cybersecurity posture. The Engineer also serves as a member of the Incident Response team.

Essential Job Functions (EJFs)

Attends work on a regular and predictable schedule following agency leave policy and performs other duties as assigned.

Security Operations Engineering & Platform Administration - 35%

• Administers, maintains, and optimizes enterprise cybersecurity technologies supporting security monitoring and incident response operations.
• Designs, implements, and supports Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR/XDR), SOAR, threat intelligence, identity protection, cloud security, email security, network security, and vulnerability management platforms.
• Manages platform configurations, data ingestion pipelines, integrations, scalability, availability, and operational health.
• Develops and maintains logging standards, monitoring requirements, and telemetry collection strategies across enterprise environments.
• Performs platform upgrades, configuration management, tuning activities, and technology lifecycle maintenance.

Detection Engineering & Security Automation - 25%

• Designs, develops, and maintains security detections, correlation searches, behavioral analytics, dashboards, reports, and threat-hunting content.
• Develops automation workflows and orchestration solutions to improve operational efficiency and response capabilities.
• Creates use cases aligned to MITRE ATT&CK techniques, threat intelligence, and agency risk priorities.
• Enhances alert quality through tuning, enrichment, suppression logic, and continuous improvement efforts.
• Develops and maintains detection-as-code and content management processes where applicable.
• Applies knowledge of scripting to automate repeatable tasks.

Security Integration & Data Engineering - 20%

• Integrates enterprise security technologies and data sources into cybersecurity monitoring platforms.
• Collaborates with infrastructure, cloud, identity, networking, and application teams to onboard new systems and services into enterprise monitoring capabilities.
• Develops data normalization, enrichment, correlation, and operational reporting solutions.
• Ensures security event visibility across cloud, endpoint, network, application, middleware, database, and authentication systems.
• Identifies gaps in telemetry coverage and develops solutions to improve security visibility.
• Evaluates emerging security technologies and monitoring solutions to improve agency cybersecurity operations capabilities.
• Participates in architecture reviews, project consultations, and cybersecurity planning efforts.
• Supports incident response activities by providing subject matter expertise regarding security technologies and platform capabilities.
• Provides technical guidance and mentorship to analysts, engineers, and project teams.

Other Duties - 10%

• Performs additional cybersecurity engineering activities as assigned, including special projects, proof-of-concept evaluations, process improvements, operational readiness initiatives, audit support, and agency cybersecurity modernization efforts.

Knowledge, Skills, and Abilities (KSAs)

Knowledge of:

• Security Operations Center architecture, processes, and cybersecurity monitoring methodologies.
• SIEM, SOAR, EDR/XDR, NDR, IPS/IDS, NGFW, threat intelligence, cloud security, identity security, and vulnerability management technologies.
• Enterprise logging, event collection, correlation, and security analytics principles.
• Automation technologies, scripting methodologies, APIs, and systems integration practices.
• Cloud computing architectures, identity and access management, networking, operating systems, and enterprise security controls.
• MITRE ATT&CK framework, cybersecurity threat landscapes, adversary behaviors, and defensive engineering concepts.
• Security frameworks and standards including NIST Cybersecurity Framework, NIST 800-53, CIS Controls, and State of Texas cybersecurity requirements (including TAC Chapter 202).

Skill in:

• Security platform administration and configuration.
• Detection engineering and security content development.
• Scripting, automation, and systems integration.
• Data analysis, event correlation, and security analytics.
• Troubleshooting complex cybersecurity technologies and integrations.
• Writing technical documentation, engineering procedures, and operational standards.
• Evaluating cybersecurity technologies and developing technical recommendations.

Ability to:

• Design, implement, and maintain enterprise cybersecurity monitoring capabilities.
• Process large security data sets to support incident response and SOC operations.
• Analyze complex technical environments and identify engineering improvements.
• Develop scalable and maintainable security engineering solutions.
• Communicate technical information to both technical and non-technical audiences.
• Work collaboratively across multiple teams and disciplines.
• Manage multiple projects, priorities, and engineering initiatives simultaneously.

Registrations, Licensure Requirements, or Certifications

• Certified Information Systems Security Professional (CISSP)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Splunk Enterprise Security Certified Admin
• Splunk Core Certified Power User
• CompTIA CySA+

Initial Screening Criteria

• Graduation from an accredited four-year college or university with major coursework in information technology security, computer information systems, computer science, management information systems, or a related field is strongly preferred. Education and experience may be substituted for one another.
• At least 5+ years of experience in information technology, cybersecurity engineering, SIEM administration, security operations, detection engineering, systems/network administration, or related disciplines.
• Experience working in a Security Operations Center (SOC).
• Experience with one or more SIEM platforms.
• Experience with security operations automation.

Additional Information

Any employment offer is contingent upon available budgeted funds. The offered salary will be determined in accordance with budgetary limits and the requirements of HHSC Human Resources Manual.

Selected candidates must be legally authorized to work in the U.S. without sponsorship.

Selected candidate must be willing to commute to the office on the required days.

Active Duty, Military, Reservists, Guardsmen, and Veterans

Military occupation(s) that relate to the initial selection criteria and registration or licensure requirements for this position may include, but not limited to those listed in this posting. All active-duty military, reservists, guardsmen, and veterans are encouraged to apply if qualified to fill this position. For more information please see the Texas State Auditor’s Job Descriptions, Military Crosswalk and Military Crosswalk Guide at Texas State Auditor's Office - Job Descriptions .

ADA Accommodations

In compliance with the Americans with Disabilities Act (ADA), HHSC and DSHS agencies will provide reasonable accommodation during the hiring and selection process for qualified individuals with a disability. If you need assistance completing the on-line application, contact the HHS Employee Service Center at 1-888-894-4747. If you are contacted for an interview and need accommodation to participate in the interview process, please notify the person scheduling the interview.

Pre-Employment Checks and Work Eligibility

Depending on the program area and position requirements, applicants selected for hire may be required to pass background and other due diligence checks.

HHSC uses E-Verify. You must bring your I-9 documentation with you on your first day of work. Download the I-9 Form

Telework Disclaimer

This position may be eligible for telework. Please note, all HHS positions are subject to state and agency telework policies in addition to the discretion of the direct supervisor and business needs.