Agency InformationThe Texas Cyber Command (TXCC) is the state's front line of cyber defense, established by the 89th Texas Legislature to protect Texans, critical infrastructure, and government systems from evolving cyber threats. Headquartered in San Antonio (a national hub of cybersecurity talent), TXCC unites threat detection, incident response, and statewide cyber readiness under one missiondriven agency to establish Texas as the most cyberresilient state in the nation. At TXCC, your work doesn't just sit in a queue it actively secures, protects, defends, and educates over 31 million Texans every day.
Job DescriptionThe Cyber Threat Intelligence Analyst performs advanced (seniorlevel) cybersecurity and information security analysis work, producing intelligence that informs Texas leadership, supports defenders across Texas Cyber Command, and enables collaboration with external partners. This role translates data, reporting, and technical findings into actionable intelligence that guides decisionmaking and strengthens cyber defense efforts. Operating under limited supervision with considerable latitude for initiative and independent judgment, the analyst works across strategic and technical domains and provides expert analysis to support the protection of state information systems and infrastructure.
Essential Job Duties Intelligence Creation and Analysis Researches, develops, and produces intelligence products that inform cybersecurity operations and executive decisionmaking. Analyzes threat actors, campaigns, and tactics, techniques, and procedures (TTPs) relevant to Texas government and critical infrastructure. Translates geopolitical and operational developments into cyber risk assessments, including identification of likely adversary actions and sectors at elevated risk. Produces a range of intelligence products, including executive briefings, strategic warning, campaign analysis, actor profiles, sectorspecific assessments, and incidentrelated reporting. Conducts indepth analytic efforts to identify trends, recurring exploit paths, access patterns, and emerging threats requiring sustained attention.
Intelligence Application and Operation Support Applies cyber threat intelligence to support cybersecurity operations and organizational decisionmaking. Develops and disseminates indicators, detection logic, and contextual reporting to enable operational use by security teams. Supports active cybersecurity incidents by providing intelligence enrichment, attribution hypotheses, and contextual analysis to accelerate detection, response, and recovery efforts. Maintains a continuous feedback loop with security operations, incident response, and forensics teams to refine intelligence requirements and improve the effectiveness of intelligence products. Researches and analyzes cybersecurity threat indicators and behaviors to support the prevention, detection, containment, and mitigation of data security threats and incidents.
Stakeholder Engagement and Communication Engages with executive leadership, partner agencies, and external stakeholders to communicate cyber threat intelligence and represent the organization s intelligence function. Presents intelligence findings through briefings, reports, and discussions tailored to technical and nontechnical audiences. Supports interagency coordination and information sharing efforts. Promotes cybersecurity awareness by communicating relevant threat information and educating stakeholders on risks, trends, and best practices.
Tradecraft, Innovation, and Continuous Improvement Maintains and advances intelligence tradecraft, analytic rigor, and continuous improvement of intelligence processes. Applies structured analytic techniques and ensures adherence to standards for sourcing, confidence assessment, and analytic integrity across all products. Leverages artificial intelligence and emerging technologies, including large language model tools, to enhance analytic workflows while exercising appropriate judgment regarding accuracy, reliability, and appropriate use. Identifies opportunities to improve methodologies, tools, and processes to increase the quality, efficiency, and impact of intelligence outputs.
QualificationsMust meet applicable U.S. citizenship requirements, successfully complete required background screening, and maintain eligibility to access the systems, facilities, and information necessary to perform assigned duties. Must successfully complete and maintain applicable operationalreadiness, incidentmanagement, and other required training within established timeframes.
Minimum Qualifications Experience: Cybersecurity Analyst III Five (5) years of experience in cyber threat intelligence, allsource intelligence analysis, or a closely related analytic discipline
Cybersecurity Analyst IV Seven (7) years of experience in cyber threat intelligence, allsource intelligence analysis, or a closely related analytic discipline
Required Experience for All Levels Demonstrated experience producing written intelligence products for varied audiences, from executive leadership to technical defenders
Working knowledge of adversary tradecraft, intrusion lifecycle concepts, and common analytic frameworks (e.g., MITRE ATT&CK, Diamond Model, kill chain)
Familiarity with indicator types, detection logic, and the lifecycle of technical indicators from discovery to dissemination
Ability to read and interpret technical artifacts (e.g., logs, network data, malware reports, vulnerability disclosures) to develop analytic judgments
Experience using AIassisted tools in an analytic workflow
Preferred QualificationsExperience: Experience producing intelligence for state, local, federal, or military consumers, or for critical infrastructure operators
Regional or actorspecific expertise in one or more of: China, Russia, Iran, or DPRK cyber programs
Sectorspecific familiarity with energy, water, elections, public safety, healthcare, or financial services threat landscapes
Experience working alongside SOC, incident response, or threat hunting teams, including during active incidents
Familiarity with CTI platforms, indicator standards (e.g., STIX/TAXII), and detection languages (e.g., YARA, Sigma) sufficient to author or review content
Experience briefing senior executives or elected officials
Experience designing, integrating, or evaluating LLMbased analytic workflows, including prompt development and handling of sensitive data
Knowledge/Skills/AbilitiesKnowledge of: Cybersecurity and information security principles, including adversary tradecraft, intrusion lifecycle concepts, analytic frameworks, and incident response practices.
Cybersecurity controls, practices, procedures, and applicable laws, regulations, and standards.
Computer systems, networks, operating systems, applications, and security technologies, including their capabilities and limitations.
Intelligence analysis principles, including sourcing, confidence assessment, and structured analytic techniques.
Skill in: Producing clear, concise, and analytically sound written products and briefings tailored to diverse audiences, including executive leadership and technical stakeholders.
Analyzing complex information, synthesizing strategic and technical context, and developing actionable insights and recommendations.
Effective oral and written communication, including presentations, collaboration, and stakeholder engagement.
Use of cybersecurity tools, software, and analytic platforms to support intelligence production and analysis.
Ability to: Exercise sound judgment in evaluating information, including assessing source reliability, analytic confidence, and limitations of available evidence.
Interpret technical artifacts (e.g., logs, network data, malware reports) to support analytic conclusions.
Work independently, prioritize tasks, and adapt in a dynamic, evolving environment.
Apply structured problemsolving, build effective working relationships, and leverage emerging technologies, including AIassisted tools, responsibly and effectively.
Working ConditionsRequired to work 8 hours per day, 5 days per week
May be required to work overtime, holidays, weekends, and hours other than regularly scheduled with supervisor approval
May be required to operate a state vehicle or vehicle on behalf of the State
Required to travel with possible overnight stays, as necessary
Required to conform to dress and grooming standards, work rules, and safety procedures
Required to follow nonsmoking policy in all state buildings and vehicles
Military/Veteran Information Military Occupation Specialty Code The Military Occupation Specialty Codes applicable to this position can be found at this link.
Selective Service Registration Section 651.005 of the Government Code requires males, ages 18 through 25 years, to provide proof of their Selective Service registration or proof of their exemption from the requirement as a condition of state employment.
Additional Information H1B Visa Sponsorship We are unable to sponsor or take over sponsorship of an employment visa. Texas Cyber Command employees of the United States.
Equal Opportunity Employer Texas Cyber Command does not exclude anyone from consideration for recruitment, selection, appointment, training, promotion, retention, or any other personnel action, or deny any benefits or participation in programs or activities, which it sponsors on the grounds of race, color, national origin, sex, religion, age, or disability. Please call to request reasonable accommodation.
How to Apply Application Requirements Every application must reflect a full employment history for each job held. You may provide this either directly in the
Work History section of your application or as an attached rsum, but either way, each position listed must include:
- Job title
- Name of employer
- Employment start and end dates (month and year)
- A summary of the duties and responsibilities you held
If a listed position was parttime, please note that in the work history section or on your rsum.
Applicants must also answer the supplemental questions in the job application. Applications missing this information may be treated as incomplete and will not move forward in the review process.
Additional Application Information - Fields that don't apply to you should be marked "N/A."
- If you're relying on education (rather than experience) to meet the minimum qualifications for this position, please attach a copy of your college transcript to your application.
- Leaving out required information could result in your application being disqualified from consideration.
Applying Through Work In Texas (WIT) If you're applying via Work In Texas, you'll also need to complete the set of supplemental questions before your application can be considered. These questions are only in CAPPS Recruit, so you'll need to register for or sign in to your candidate profile: Access CAPPS Candidate Gateway
Need some help putting together a rsum? Work In Texas offers a "Create a Rsum" tool for job seekers on their website .
Contact InformationIf you have any questions, please reach out to TXCC Human Resources at .
