Sr. IT Security Administrator
County of Orange
An application made for this job — a tailored resume and cover letter that speak straight to the posting.
Job summary
County of Orange seeks a Senior IT Security Administrator to lead a security-analyst team protecting the Sheriff’s network and data. You will manage incident response, threat monitoring, and compliance with CJIS, NIST, ISO, PCI, and HIPAA while guiding architecture reviews for cloud, on-premises, and remote access.
You will collaborate across divisions, implement security controls, and ensure change management and documentation are maintained to support ongoing public-safety operations.
Qualifications
- Experience administering enterprise security technologies and policies.
- Ability to analyze endpoint, identity, network, email, and cloud telemetry.
- Investigate incidents, document findings, and coordinate remediation.
- Apply risk-based security controls and maintain compliance.
- Ability to communicate risk to technical and executive audiences.
Responsibilities
- Supervise a team of security analysts ensuring protection of OC Sheriff network.
- Monitor telemetry, validate alerts, contain incidents, and document in ServiceNow.
- Administer and tune security platforms and detection rules.
- Support audits and CJIS/NIST/ISO/PCI/HIPAA compliance.
- Collaborate with stakeholders to resolve security issues enterprise-wide.
- Maintain security standards, runbooks, and change-management processes.
- Participate in after-hours incident response and on-call coverage.
Skills
Education
Tools
Job description
Salary may be negotiable within the range listed above, based on position requirements and successful candidate's qualifications, subject to appropriate authorization.
This recruitment will establish an open eligible list that will be used to fill current and future Sr. IT Security Administrator positions. The eligible list established may also be used to fill positions in similar and/or lower classifications throughout the County of Orange.
Recruitment is open to the public and will remain open on a continuous basis for a minimum of five (5) business days, until the needs of the Department are met. Qualified applicants are encouraged to apply immediately.
The Orange County Sheriff’s Department is among the largest in the nation, providing exemplary law enforcement services focused on a collaborative, dedicated and innovative approach to public safety.
Our nearly 4,000 sworn and professional staff are committed to serving the needs of Orange County through six organizational Commands comprised of 23 Divisions. Together, these Commands and Divisions provide services including land, air and sea-based patrol, custody operations, investigative services, emergency management, coroner services, forensics and specialty operations, among an extensive list of other public safety services.
Click here for more information on Technology Division.
Click here for more information on the County of Orange.
Technology Division has an excellent opportunity for a Sr. IT Security Administrator who will be responsible for supervising a team of security analysts who ensures the entire security of the O.C. Sheriff’s network; preventing and mitigating malicious attacks against the department's network infrastructure, ensuring the network complies with CJIS (Criminal Justice Information System) requirements, administrating security controls to enforce our security policies, and providing security awareness training to employees.
- Monitor security telemetry; validate and prioritize alerts; investigate suspected compromise; contain, eradicate, and coordinate recovery; preserve evidence; and document incidents in the approved case-management and ServiceNow workflows.
- Administer and tune enterprise security platforms, including Palo Alto XSIAM/XDR, endpoint controls, security integrations, email-security tooling, logging pipelines, detection rules, dashboards, and automated response playbooks.
- Conduct vulnerability, exposure, and risk management: assess findings, validate exploitability and business impact, assign remediation priorities, coordinate corrective actions, verify closure, and report residual risk.
- Engineer and support identity-security controls for Active Directory and Microsoft Entra ID, including privileged access, PIM, MFA, conditional access, service accounts, guest access, and least-privilege reviews.
- Evaluate and document compliance with CJIS/CLETS, NIST, ISO, PCI, HIPAA, County policy, and applicable retention requirements; support audits, evidence requests, control testing, exceptions, and corrective-action plans.
- Provide security architecture and engineering review for infrastructure, cloud, application, network, remote-access, and third-party initiatives; define controls and securely integrate new technologies without disrupting public-safety operations.
- Develop and maintain security standards, procedures, runbooks, knowledge articles, asset/control documentation, metrics, risk registers, and executive or operational reports; perform work through approved change-management processes.
- Partner with Network, Server/Storage, Applications, Service Desk, executives, County stakeholders, law-enforcement agencies, and vendors to resolve security issues, improve awareness, and coordinate enterprise remediation.
- Manage vendor and agency security coordination, including technical due diligence, access requirements, support escalations, product evaluations, incident communications, and validation of contractual security commitments.
- Maintain professional readiness through threat research, product training, exercises, and knowledge transfer; participate in after-hours incident response, maintenance, and on-call coverage when assigned.
The ideal incumbent would have progressively responsible experience administering enterprise security technologies; analyzing endpoint, identity, network, email, and cloud telemetry; investigating and documenting incidents; managing vulnerabilities and remediation; and applying risk-based security controls. The person should understand Active Directory and Entra ID, networking and firewall concepts, Windows/Linux and cloud fundamentals, scripting or automation, change management, evidence handling, and security frameworks. Strong analytical writing, customer service, teamwork, discretion, and the ability to explain risk to technical and executive audiences are essential. OCSD-specific systems, procedures, and agency relationships can be learned through normal onboarding; advanced incident response and threat investigation; administration of SIEM/XDR/SOAR and endpoint controls (Palo Alto XSIAM/XDR experience is especially relevant); identity and privileged-access security; vulnerability and exposure management; cloud and network security; detection engineering and automation; and documented experience applying CJIS, NIST, ISO, or comparable control frameworks. The candidate should demonstrate sound independent judgment, calm incident leadership, concise documentation, cross-team influence, and respect for change control and public-sector accountability.
Click here to learn more about the Sr. IT Security Administrator minimum qualifications.
College level education or training directly related to the competencies and attributes required of the position may be substituted for up to one year of the required experience at the rate of three semester units or the equivalent, equaling one month of experience and one hour of training equaling one hour of experience. College level education or training beyond a bachelor's degree, which is directly related to the competencies and attributes required of the position, may be substituted for up to an additional year of required experience at the same rate identified above.
Three years performing security administration at a level that is comparable to the County of Orange classification of IT Security Administrator II.
Depending upon assignment, some positions in this class may require possession of a valid California driver's license, Class C or higher. Depending upon assignment, demonstrated professional level competency and/or certification pertaining to the information technologies used by the County may be required. Certifications such as CISSP and SSCP and may be required.
Applicants must not have been convicted of a felony or be on any form of probation and must pass an extensive background investigation to the satisfaction of the Orange County Sheriff-Coroner. Background screening includes completing of a Personal History Form, interview with a background investigator, fingerprinting and may include a polygraph test. Some of the areas considered in the background screening include prior convictions, traffic violations, drug use and credit problems, employment history, professional references and education verification (i.e. degree, license, or official transcripts). Foreign degrees require an evaluation of U.S. equivalency by an agency that is a member of the National Association of Credentials Evaluation Services (N.A.C.E.S.).
Frequent standing or sitting for extended periods; frequent walking; occasional driving may be required, depending upon assignment; infrequent pushing/pulling; infrequent bending, kneeling, squatting and crawling; infrequent lifting up to 25 pounds; constant use of good overall vision for reading/close up work; infrequent use of color perception and occasional eye/hand coordination; frequent repetitive motion from writing and using a computer keyboard; occasional grasping, holding and reaching; frequent hearing/talking to others on the telephone and in person; frequent decision making and concentration; occasional public contact; occasional working alone. Additional physical/mental requirements or frequencies may be required, depending upon assignment.
Work is typically performed in an indoor office environment, but occasionally requires travel to other locations. Work environments may include high levels of noise, dust and/or unpleasant odors. Occasional early morning, evening, holiday and/or weekend work may be required.
Sheriff Human Resources will screen all application materials to identify qualified applicants. After screening, qualified applicants will be referred to the next step and notified of all further procedures applicable to their status in the competition.
Applications and supplemental responses will be screened for qualifications that are highly desirable and most needed to successfully perform the duties of this job. Only those applicants that meet the qualifications as listed in the job bulletin will be referred to the next step.
An Application Appraisal Panel (AAP) of job knowledge experts will thoroughly screen and evaluate the application, and supplemental questionnaire for job knowledge, competencies, and related experience described above. Only the most qualified candidates will advance to the next step in the recruitment process or will be placed on the eligible list.
The Structured Oral Interview is a timed assessment. Applicants will provide answers to job-related questions, which will be rated by a panel of subject matter experts using standardized evaluation criteria. Only the most qualified candidates will move forward to the next step in the recruitment process or will be placed on the eligible list.
Once the assessment has been completed, Sheriff Human Resources will establish an eligible list of candidates. Candidates placed on the eligible list may be referred to a selection interview to be considered for present and future vacancies.
Based on the County's needs, the selection procedures listed above may be modified. All candidates will be notified of any changes in the selection procedures.
The County is committed to providing a mechanism to give preferential consideration in the employment process to veterans and their eligible spouses and will provide eligible participants the opportunity to receive interviews in the selection process for employment and paid internship openings. Please click here to review the policy.
The County of Orange is committed to providing reasonable accommodations to qualified individuals with disabilities. Individuals who require a reasonable accommodation during the application or selection process should notify the recruiter listed on the job posting as soon as possible. Documentation supporting the accommodation request may be required.
Email is the primary form of notification during the recruitment process. Please ensure your correct email address is included in our application and use only one email account. NOTE: User accounts are established for one person only and should not be shared with another person. Multiple applications with multiple users may jeopardize your status in the recruitment process for any positions for which you apply. Candidates will be notified regarding their status as the recruitment proceeds via email through the GovernmentJobs.com site. Please check your email folders, including spam/junk folders, and/or accept emails ending with "governmentjobs.com" and "ocgov.com." If your email address should change, please update your profile at www.governmentjobs.com.
Click here for additional Frequently Asked Questions. For specific information pertaining to this recruitment, contact Mary Cortez-Valadez at mcortez-valadez@ocsheriff.gov or 714.834.5834.
Orange County, as an equal employment opportunity employer, encourages applicants from diverse backgrounds to apply.
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
