Job Description

Requisition No: 882525

Agency: Management Services

Working Title: CYBERSECURITY OPERATIONS CENTER ANALYST - 72004161

Pay Plan: Career Service

Position Number: 72004161

Salary: $70,000 - $105,000.00

Posting Closing Date: 09/08/2026

Total Compensation Estimator Tool

Cybersecurity Operations Center Analyst

Florida Digital Service

State of Florida Department of Management Services

This is an in-office position located in Tallahassee, FL

Position Overview and Responsibilities:

The Cybersecurity Operations Center (CSOC) Analyst supports real-time cybersecurity monitoring, detection, and incident response for Florida’s state enterprise. Leveraging centralized telemetry, the CSOC Analyst identifies, analyzes, and responds to threats across multiple platforms, ensuring the protection of state systems and data.

This role is critical in correlating threat intelligence, validating alerts, supporting investigations, and collaborating with detection engineering and incident response teams to improve Florida’s cyber defense

Key Responsibilities:

• Monitor, analyze, and respond to security events from SIEM, EDR, IDS/IPS, DNS, firewall, cloud, and identity sources.
• Triage and prioritize alerts, escalating incidents per CSOC procedures and incident response playbooks.
• Correlate security telemetry with threat intelligence and behavioral analytics to identify anomalies and malicious activity.
• Provide contextualized threat intelligence to partner agencies and coordinate appropriate response.
• Conduct proactive threat hunting using industry standard query languages.
• Collaborate with detection engineering to validate alerts and enhance detection rules.
• Document investigations and incident response activities in case management systems.
• Assist in containment, eradication, and recovery efforts during incident response.
• Produce clear incident and investigation reports for both technical and non-technical audiences.
• Stay informed on current cybersecurity threats, tactics, techniques, and procedures (TTPs).
• Other related duties as required.

Knowledge, Skills and Abilities:

Knowledge of:

• Cyber Threat Intelligence analysis and production methods.
• Cybersecurity principles (CIA triad, defense-in-depth, MITRE ATT&CK).
• Alert tuning and detection engineering.
• Cyber Threat Hunting methodology, hypothesis driven threat hunting.
• Incident response lifecycle and NIST SP 800-61 guidance.
• Common attack vectors and detection strategies.

Skills in:

• Log analysis across diverse sources (EDR, SIEM, network appliances, cloud services).
• Cyber Threat Intelligence analysis and production methods.
• Alert tuning and detection engineering.
• Security event correlation, enrichment, and alert tuning.
• Using log query languages such as KQL and SQL, and analysis tools such as query engines or search/analytics platforms (e.g., distributed search, indexing, and visualization systems)

Abilities to:

• Follow standard operating procedures and escalate appropriately.
• Write clearly, specifically in the context of threat intelligence and threat analysis.
• Communicate clearly in writing and verbally, including documenting investigations.
• Work independently or in a team under high-pressure conditions.

Minimum Qualifications:

Education

• Associate’s degree in Cybersecurity, Computer Science, or related field OR equivalent combination of education and experience.

Experience:

• 3+ years in a cybersecurity operations, SOC analyst, or related role.
• Hands-on experience with SIEM tools (e.g., Splunk, Sentinel, Google SecOps OpenSearch, etc.), EDR, or firewall logs.
• Familiarity with cloud platforms and log query languages (KQL, SQL, etc.), Threat Intelligence Platforms.

Certification:

• CompTIA Security+ (required within 12 months of hire).

Other Requirements:

• Eligible to work in the U.S. without sponsorship.
• Ability to participate in on-call rotation and occasional after-hours work

PREFERRED QUALIFICATIONS

• Bachelor’s degree in Cybersecurity, Computer Science, or related discipline.
• Cloud security certifications (Microsoft Azure, Amazon AWS).
• SANS GCTI (Cyber Threat Intelligence)
• Experience in government, public sector, or regulated environments.
• Hands-on threat hunting and behavioral analytics experience.

On-Call Assignment – This position has been approved in accordance with Section 110.209, Florida Statutes, Chapter 60L-32, Florida Administrative Code, and Collective Bargaining Agreements with the Florida Nurses Association (FNA) and the American Federation of State, County, and Municipal Employees (AFSCME), Florida Council 79. The approved On-Call form has been forwarded to the servicing human resource office.

Criminal background investigation including fingerprinting and statewide and national criminal history records check per Section 110.1127 Florida Statutes, Chapter 435 Florida Statutes, and the Federal Bureau of Investigation’s CJIS Security Policy CJISD-ITS-DOC-08140-4.5

Ability to sit for extended periods of time. Ability to stand for extended periods of time. Ability to drive and/or fly for long distances. Ability to lift, push and pull up to 30lbs.

Pursuant to F.S. 215.422 every officer or employee who is responsible for the approval or processing of vendors’ invoices or distribution of warrants to vendors are mandated to process, resolve, and comply as section 215.422 requires.

Our Organization and Mission:

Under the direction of Governor Ron DeSantis, Secretary Tom Berger and DMS’ Executive Leadership Team, the Florida Department of Management Services (DMS) is a customer-oriented agency with a broad portfolio that includes the efficient use and management of real estate, procurement, human resources, group insurance, retirement, telecommunications, fleet, and federal property assistance programs used throughout Florida’s state government. It is against this backdrop that DMS strives to demonstrate its motto, “We serve those who serve Florida.”

Special Notes:

DMS is committed to successfully recruiting and onboarding talented and skilled individuals into its workforce. We recognize the extensive training, experience, and transferable skills that veterans and individuals with disabilities bring to the workforce. Veterans and individuals with disabilities are encouraged to contact our agency recruiter for guidance and answers to questions through the following provided email addresses:

DMS.Ability@dms.fl.gov

DMS.Veterans@dms.fl.gov.

An individual with a disability is qualified if he or she satisfies the skills, experience, and other job-related requirements for a position and can perform the essential functions of the position with or without reasonable accommodation. For purposes of requesting reasonable accommodations, as mentioned above, the agency hiring authority is the DMS Human Resources office, which the candidate can reach at (850) 488-2707.

Successful completion of background screening will be required for this position.

Candidates requiring a reasonable accommodation, as defined by the Americans with Disabilities Act, must notify the agency hiring authority and/or People First Service Center (1-866-663-4735). Notification to the hiring authority must be made in advance to allow sufficient time to provide the accommodation.

The State of Florida supports a Drug-Free workplace. All employees are subject to reasonable suspicion drug testing in accordance with Section 112.0455, F.S., Drug-Free Workplace Act.

VETERANS’ PREFERENCE. Pursuant to Chapter 295, Florida Statutes, candidates eligible for Veterans’ Preference will receive preference in employment for Career Service vacancies and are encouraged to apply. Certain service members may be eligible to receive waivers for postsecondary educational requirements. Candidates claiming Veterans’ Preference must attach supporting documentation with each submission that includes character of service (for example, DD Form 214 Member Copy #4) along with any other documentation as required by Rule 55A-7, Florida Administrative Code. Veterans’ Preference documentation requirements are available by clicking here. All documentation is due by the close of the vacancy announcement.