Cybersecurity Analyst

Job Description:

Job Number 2025-00178

KCLS is seeking a Cybersecurity analyst to support the protection of KCLS infrastructure and data through security monitoring, incident response, and vulnerability management. In the position, you will have the opportunity to:

• Manage cybersecurity tools, analyzes events, and collaborates with individuals & departments across KCLS to remediate threats
• Serve as a technical subject matter expert
• Provide insights that inform security policies
• Ensure compliance with privacy regulations and public library standards.
• Gain experience in various aspects of cyber security (Ex: pen testing, packet analysis, triage, remediation)
• Work and experiment with various AI tooling to stay up to date with what security risks they may present
• Build automated security workflows utilizing various tools such as: Tines, Python, Powershell, Fusion, etc.

This is a perfect opportunity for you if you are detail oriented, aren't afraid to try something new, and are willing to consider all possibilities for a given set of facts. Creative thinking is encouraged and a willingness to learn is a must as the security field is always changing!

About King County Library System (KCLS):

KCLS has a vision of a world where knowledge allows diverse communities to prosper and grow. In order to support this vision, we create opportunities through meaningful connections by acting as the knowledge sharing center for over 1.5 million diverse patrons, providing an unparalleled collection of library materials, resources, technology, services, and programs.

Approximately 1,000 engaged and passionate staff provide service in 50 community library locations and patron engagement using direct outreach, programs, and virtual assistance. Our service area includes cities, towns, tribal lands, and unincorporated districts of King County, with the exception of the city of Seattle.

From a 2021-2022 comprehensive Diversity, Equity, and Inclusion (DEI) Assessment Demographics and Language Report, of the more than 1.5 million residents who live within the KCLS service area, almost half identify as Black, Indigenous, or People of Color (BIPOC). Moreover, roughly one-third of the KCLS community speaks a language other than English as their first language.

The King County Library System values the diverse perspectives, lived experiences, and cultures of all qualified individuals. We seek applicants that reflect the diversity of the communities we serve and encourage individuals of all backgrounds to apply, including BIPOC (Black, Indigenous, and other people of color), immigrants, refugees, women, LGBTQIA+, individuals with disabilities, veterans, etc.

KCLS welcomes reasonable accommodations for persons with disabilities as an opportunity to assist qualified individuals to participate in the job application or interview process and/or perform the essential functions of the position upon hire.

Need an accommodation to apply or interview? Call or email.

KCLS ensures equal opportunities and consideration for all job applicants, without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws. KCLS does not tolerate discrimination or harassment during any stage of employment, including in recruiting, hiring, promotion, termination, leave of absence, compensation, or training.

Essential Duties/Major Responsibilities:

The items listed in this section are the key duties and responsibilities for this job and do not represent an exhaustive list. Our organization is dynamic and therefore duties may change based on business necessity; however, any new duties will remain within the scope of the job.

• Monitors and analyzes security information and events through SIEM and log review across multiple systems to ensure that security events are identified and analyzed promptly.
• Maintains, tests, and troubleshoots security tools for system stability (e.g., firewalls, IDS/IPS, endpoint protection platforms).
• Responds to security incidents, serving as first responder for security alerts and coordinating containment activities with IT teams.
• Performs vulnerability assessments, control validation, and systems security testing to validate effectiveness of security controls.
• Conducts systems security assessments to ensure compliance with policies, data privacy and confidentiality regulations, and related best practices.
• Collaborates with various organizational partners to implement security controls and features. Acts as a liaison with ITS teams, library staff, and external agencies to resolve security issues.
• Creates and updates detailed security documentation including incident reports and operational procedures.
• Tracks and reports security metrics to inform organizational awareness and policy updates.
• Supports security initiatives led by the Cybersecurity Manager, including strategic projects and awareness activities.
• Maintains current knowledge of evolving cyber threats and security technologies relevant to public sector organizations.

Secondary Duties:

1. Assists with policy development and special projects.
2. Contributes to staff security awareness efforts and supports training activities.
3. Supports identity and access management initiatives.
4. Attends and actively participates in meetings, trainings, and serves on various committees as assigned.
5. Performs other related duties as assigned.

Core Competencies

Organizational Competencies:

• Valuing Diversity: Manages relationships with all kinds and classes of people inclusively and equitably. Respects, values, and encourages the unique dimension each employee adds to the organization and each member of the community brings to the whole. Seeks opportunities to learn about differences.
• Customer Focus: Primarily focused on customer needs. Able to deliver high-quality, value-added services. Constantly strives to find new ways to increase customer satisfaction and understanding, foster equitable services, and forge meaningful connections.
• Ethics, Values and Judgement: Exercises best judgment, trustworthiness, and professional standards of conduct. Consistently demonstrates organization s values, moral principles, and accountability in behavior, character, and action. Defends intellectual freedom and confidentiality.
• Professional and Technical Knowledge: Demonstrates proficiency in professional and technical skills and/or knowledge in position-related areas. Purposely keeps up with current developments and trends in areas of expertise, in order to better foster personal success and connections for others.

Job-Specific Competencies:

• Organizing and Planning: Establishes courses of action for self. Can influence others to ensure that work is efficient. Appropriately sensitive to real restraints on time and resources. Willing to take a risk.
• Decision Quality: Makes decisions and solves problems. Can deal adeptly with varied levels of complexity, ambiguity, and risk. Takes responsibility and accepts ownership for decisions regardless of outcome. Responds promptly and appropriately in crisis situations.
• Accountability: Holds self, direct reports, and others accountable for achieving intended outcomes. Follows up and monitors progress to ensure that things stay on track. Models organizational values and norms.
• Communicates Effectively: Conveys ideas and information in a way that is clear, engaging, and suitable to the audience. Main point of their message is apparent. Listens more than they speak and responds appropriately. Seeks influence.

Education and Experience:

The items listed below are the minimum requirements for the job and are relevant to this position. The organization values both work experience and education and realizes that individuals take different paths to acquire knowledge.

• Bachelor's degree from an accredited school in cybersecurity, information security, computer science, information technology, or related field.
• At least one professional certification in cybersecurity operations, incident response, or security analysis required (e.g., SSCP, Security+, CySA+, GCIH, GSEC), or ability to obtain within 6 months of hire.
• Four years of experience in security operations, incident response, or security analysis with demonstrated experience in SIEM platforms and security tool management.
• Any equivalent combination of education and experience that provides the necessary qualifications to successfully perform the duties of the position will be considered.

Knowledge and Skills:

• Proficiency in security monitoring, incident response, and vulnerability management processes.
• Technical expertise with security tools such as SIEM, firewalls, IDS/IPS, and endpoint protection platforms.
• Skills in security analysis techniques including log analysis, threat hunting, and risk evaluation.
• Model for security-conscious behavior and incident response readiness.
• Ability to prioritize and manage multiple security incidents under time-sensitive conditions.
• Analytical and decision-making skills to assess security threats to determine optimal response.
• Attentive to detail and accuracy in security documentation and evidence handling.
• Effective communication skills.
• Develop and maintain cooperative working relationships with ITS teams and library staff.
• Flexibility to adapt to evolving threats and shifting security priorities.

Professional Licenses and Certifications:

• A valid Washington State driver's license is required.

Physical Demands:

Constantly sit throughout work shift and seldom will stand and walk. Seldom reach up or down and frequently reach out at chest level with hands and arms. Constantly use hands in conjunction with frequent finger use. Keyboarding may be repetitive up to occasionally. Rotate neck up to occasionally. Change tasks depending upon the shift. Require extensive close work, including use of a computer monitor. Seldom operate foot controls. Occasionally lift up to 10 pounds, seldom up to 35 lbs., and seldom will carry up to 20 lbs. Seldom push or pull carts and wheeled equipment with light force.

Work Environment:

Work is performed in a typical office environment. New, unusual, hectic, demanding, or risky situations are encountered periodically. Resources are available to assist with identifying solutions or actions. Work schedule may include occasional early morning, evening, and/or weekend meetings or commitments. Some travel within the service area is required. Incumbent may be permitted hybrid telework schedule upon request.