Job Description

The Network Security Analyst will support the Texas Health and Human Services Commission (HHSC). This role performs advanced cybersecurity and network security analysis in support of HHSC's enterprise security operations, with responsibility for monitoring, detecting, investigating, and responding to security events across on-premises, cloud, and endpoint environments. The candidate will function as a hands-on security operations professional with strong experience across SIEM, SOAR, EDR, and network detection and incident response platforms. The role requires sound judgment, technical depth, attention to detail, and a strong commitment to protecting HHSC systems, data, and services that support the health and well-being of Texans. The candidate will work independently and collaboratively within a security operations environment handling shifting priorities and time-sensitive incidents. Responsibilities Monitor security alerts, logs, network events, endpoint telemetry, and threat intelligence feeds. Analyze suspicious activity, anomalous network behavior, malware indicators, endpoint detections, and SIEM correlation events to determine scope, impact, and required response actions. Perform incident triage, investigation, escalation, containment coordination, and documentation in accordance with HHSC security operations procedures. Develop, tune, and maintain detection rules, dashboards, alerts, playbooks, and queries to improve visibility across network, endpoint, identity, and cloud environments. Support threat hunting activities using KQL, SPL, packet and session analysis, endpoint telemetry, and other investigative techniques. Assist with vulnerability, risk, and control assessments for network security infrastructure and enterprise information systems. Document findings, prepare incident reports, track corrective actions, and communicate technical information to security leadership and business stakeholders. Collaborate with network, infrastructure, cloud, endpoint, and application teams to validate security events and implement risk mitigation measures. Maintain awareness of emerging cyber threats, attack techniques, indicators of compromise, and security best practices relevant to healthcare and public-sector environments. Support compliance, audit, and reporting activities by providing evidence, metrics, and security operations documentation as requested. Requirements Minimum Qualifications 7 years of knowledge of SIEM, SOAR, EDR, XDR, and NDR. 7 years of experience with security log collection and management. 7 years of experience with threat intelligence concepts. 7 years of skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting. 7 years of experience in SIEM platform and architecture support. 7 years of experience in detection engineering methodology and implementation. Preferred Qualifications 10 years of knowledge of SIEM, SOAR, EDR, XDR, and NDR. 10 years of experience with security log collection and management. 10 years of experience with threat intelligence concepts. 10 years of skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting. 10 years of experience in SIEM platform and architecture support. 10 years of experience in detection engineering methodology and implementation. Additional Requirements Candidates and vendors may be required to satisfy criminal background checks as authorized by Texas law. Candidates must already reside in Texas; out-of-state candidates planning to relocate will not be accepted. Work Location and Schedule Location: 701 W 51st St, Austin, TX 78751 Schedule: Monday through Friday, 8:00 a.m. to 5:00 p.m., excluding Texas state holidays; may occasionally require work outside normal business hours on evenings, weekends, or holidays with pre-approval. Work Arrangement: Onsite; no remote work; local candidates only