Security Analyst II/III

Gaston County Government; Gastonia (NC); On-site; USD 47,000 - 61,000; Full time

Job summary

Gaston County Government seeks a Security Analyst II/III to monitor, investigate, and respond to cybersecurity incidents across endpoints, networks, identity, email, cloud, and servers. The role emphasizes incident response, vulnerability management, and security engineering to protect county services.

Candidates should hold a Bachelor's degree with 8+ years IT experience, including cybersecurity, and have at least one cybersecurity certification.

Qualifications

• Bachelor's degree required with 8+ years IT experience, including cybersecurity.
• At least one cybersecurity certification (e.g., Security+, CySA+, CASP+, CISSP).
• Valid Driver's license.

Responsibilities

• Alert and Incident Response: monitor, investigate, and respond to cybersecurity alerts across endpoints, networks, identity, email, cloud, and servers.
• Security Engineering and Hygiene: implement and improve security controls across MS 365, Entra ID, AD, Windows Server, endpoints, firewalls, and cloud services.
• Vulnerability Management: identify, track, remediate, validate vulnerabilities and coordinate patching with IT teams.
• Security Awareness, Audits, and Compliance: support governance, audits, risk management, and controls aligned with NIST and HIPAA.

Education

Bachelor's degree in IT or related field

Tools

M365

Entra ID

Active Directory

Windows Server

Job description

Provide secure, innovative, and efficient technology that enhances collaboration and empowers County departments to deliver outstanding public service.

The anticipated hiring range for the Security Analyst II is $33.80 - $40.14

The anticipated hiring range for the Security Analyst III is $37.50 - $44.53

The duties listed below are not all of the duties that may be assigned but are those that are considered as essential for an employee to perform.

• Alert and Incident Response: Monitor, investigate, and respond to cybersecurity alerts and incidents across endpoint, network, identity, email, cloud, and server environments. Analyze alerts from SIEM, EDR, firewalls, Microsoft 365/Entra ID, email security, and other security platforms to determine scope, severity, and potential business impact. Investigate indicators of compromise, suspicious authentication activity, malware, unauthorized access, and other anomalous behavior. Perform root cause analysis and coordinate containment, eradication, remediation, and recovery activities with other IT teams and County departments. Document incidents, investigative findings, actions taken, and lessons learned. Assist with tuning detections, reducing false positives, improving monitoring capabilities, and developing incident response procedures and playbooks.
• Security Engineering and Hygiene (M365/Entra, Firewalls, Endpoint): Implement, maintain, evaluate, and improve technical security controls across Microsoft 365, Entra ID, Active Directory, Windows Server, endpoint security, firewalls, networking, cloud services, and related security platforms. Review configurations, authentication and access controls, endpoint protections, firewall policies, security baselines, and system exposure to identify and remediate security weaknesses. Support identity protection, privileged access, MFA, conditional access, endpoint detection and response, network security, and other preventative security controls. Perform cybersecurity reviews of proposed software, hardware, cloud services, and technology purchases and provide risk-based recommendations. Participate in vendor security assessments and third-party risk reviews. Assist with security architecture, disaster recovery, backup validation, and business continuity activities, including consideration of RPO/RTO and cyber recovery requirements.
• Vulnerability Management:Perform ongoing identification, analysis, prioritization, tracking, remediation, validation, and reporting of vulnerabilities affecting County technology assets. Review vulnerability scan results and security advisories and analyze CVEs, CVSS scores, exploit availability, known exploitation, asset exposure, system criticality, and potential organizational impact to determine remediation priority. Work with infrastructure, networking, application, and support teams to coordinate patching, configuration changes, upgrades, compensating controls, or other remediation activities. Validate remediation and identify recurring or systemic security weaknesses. Maintain vulnerability documentation and metrics, communicate significant risks to appropriate technical and management personnel, and support continuous improvement of vulnerability and patch-management processes.
• Security Awareness, Audits, and Compliance (HIPAA/NIST):Support County cybersecurity governance, security awareness, audit, risk management, and regulatory compliance activities. Assist with internal and external audits, security assessments, evidence collection, remediation tracking, and implementation of controls aligned with NIST, HIPAA, CJIS, and other applicable requirements. Develop and maintain cybersecurity standards, procedures, technical documentation, security guidance, and supporting evidence. Communicate cybersecurity risks and security requirements to County departments, IT personnel, management, vendors, and other stakeholders and recommend appropriate mitigation strategies. Participate in security awareness initiatives and provide technical security guidance to users and IT staff. Support vendor and third-party risk assessments and assist with documenting identified risks and corrective actions. Maintain professional cybersecurity knowledge through continuing education, technical training, seminars, and review of emerging threats and security practices.

• Bachelor's degree with 8+ years of IT experience, including 3+ years in cybersecurity-related roles.
• At least one cybersecurity-focused certification (e.g., Security+, CySA+, CASP+, CISSP, or equivalent)
• Valid Driver's license

Candidates must possess advanced incident response expertise, including leading end-to-end investigations, analyzing alerts from EDR and other sources, performing root cause analysis, and coordinating containment, eradication, and recovery actions. Must have an understanding of disaster recovery, incident response coordination, and business continuity concepts, including recovery strategies and dependencies.

The applicant selected must undergo a criminal background check and pass a drug screening test prior to employment