Security Analyst II – Threat Hunter (ISS7)

Initial Posting Date:
10/23/2026

Application Deadline:
11/08/2026

Agency:
Department of Administrative Services

Salary Range:
$6,846 - $10,344

Position Type:
Employee

Position Title:
Security Analyst II – Threat Hunter (ISS7)

Job Description:

Security Analyst II – Threat Hunter (ISS7)

Salem, OR  - Hybrid

Enterprise Information Services (EIS) is a state government-wide information technology (IT) organization led by Oregon’s State Chief Information Officer (CIO). The Cyber Security Services (“CSS”) is an information security management section within EIS. CSS’s mission: Leading Oregon Government to safeguard the State’s information resources. CSS is comprised of the following units: Governance Risk and Compliance, Enterprise Security Architecture, Network Security, and Security Operations Center (SOC).

What You’ll Do

As the Security Analyst II - Threat Hunter you’ll continuously monitor Microsoft Sentinel and Defender XDR for security threats, perform initial triage to validate and assess alerts, perform network threat detection and analysis, and provide timely, actionable notification and escalation to support effective incident response and protect state agencies from cyber threats.

Review the full position details, duties and working conditions here.

What We Are Looking For

- Six (6) years of information systems experience in: Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics ; OR

- An Associate's degree in Computer Science, Information Technology, or related field, OR completion of a two (2) year accredited vocational training program in information technology or related field; AND four (4) years of information systems experience in:  Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics; OR

- A Bachelor's degree in Information Technology, Computer Science, or related field AND two (2) years of information systems experience in: Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics; OR

- Master's degree in Information Technology, Computer Science, or related field may substitute for all of the above.

Desired skills and attributes: If you bring these skills and experience, be sure to show us—this is how we evaluate candidates for next steps!

- Ability to perform deep incident investigations using Microsoft Sentinel Investigation Graph, entity behavior analytics (UEBA), and similar SIEM, XDR, EDR, and security investigation platforms.
- Ability to pivot across multiple security tools and data sources (e.g., Defender, Sentinel, Purview, Entra ID, Tenable One, email security, firewall, proxy, and network monitoring platforms) to develop investigative context and determine attack scope.
- Advanced KQL (Kusto Query Language) capability, including the ability to build complex queries, joins, unions, time-series queries, anomaly detection patterns, custom hunting queries, and scheduled analytics rules.
- Strong proficiency in investigating and correlating security telemetry across identity, endpoint, network, cloud, and email environments, including (but not limited to) Entra ID sign-in logs, Microsoft 365 audit logs, Windows event logs (including Sysmon), DNS, proxy, VPN, firewall, EDR, and network flow data; capable of identifying credential compromise, privilege escalation, lateral movement, command-and-control activity, persistence mechanisms, and data exfiltration.
- Strong understanding of adversary tradecraft and attack methodologies, including persistence, privilege escalation, credential access, defense evasion, lateral movement, command-and-control, and data exfiltration techniques, with the ability to map findings to the MITRE ATT&CK framework.
- Ability to leverage internal and external threat intelligence to develop threat-hunting hypotheses, enrich investigations, identify emerging adversary techniques, and proactively detect malicious activity.
- Ability to translate hunting findings into new detections, analytics rules, correlation logic, automation workflows, and improvements to the organization's detection and response capabilities.
- Capable of recommending and executing response actions, such as device isolation, account containment, IP or domain blocking, detection tuning, and rule development to reduce organizational risk.

- Understand and executes the full incident response lifecycle from detection and triage through scoping, containment, eradication, recovery, and post‑incident review, including making timely containment decisions, performing root‑cause analysis, and ensuring complete documentation and communication throughout the incident.
- Experience securing, monitoring, and investigating threats within AWS cloud environments, including IAM, CloudTrail, GuardDuty, and cloud-native logging and security services.

- Demonstrated skill and ability to collaborate with teammates and build positive business relationships with superiors, subordinates, peers, and others outside of their organization.

Preference Statement

Preference will be given to candidates with one or more of the following certifications: CISSP: (Certified Information Systems Security Professional), SC-200: Microsoft Security Operations Analyst, SC-100: Cybersecurity Architect, AZ-500: Azure Security Engineer,  CompTIA CySA+ or Security+ ,  GIAC (GCIA, GCIH, GMON) for advanced threat hunting or other closely related certifications.

Benefits of Joining Our Team

The Department of Administrative Services (DAS) Team strives to create an environment that is supportive and encourages work-life balance and innovation. Enterprise Information Services (EIS) is a state government-wide Information Technology (IT) program led by an administrator who also serves as Oregon’s Chief Information Officer (CIO). The EIS team is built on collaboration, support, and accountability. We work together to ensure our customer agencies receive the highest quality of service. We take pride in our work and look for ways to innovate. EIS is committed to hiring highly skilled, diverse and dedicated employees who will bring a unique skill set to the team.

Our amazing benefits include:

- Comprehensive Health Coverage: Low-cost medical, vision, and dental plans for you and your family. Additional benefits include life insurance, short- and long-term disability, deferred compensation savings plans, and flexible spending accounts for health and childcare.  Optional benefits including life insurance, disability, FSA, and more
- Generous Paid Time Off: 11 holidays, 3 personal business days, monthly sick leave and vacation leave that increases with years of service.
- Career Development: Opportunities for professional growth and advancement.
- Get There (https://getthereoregon.org/) - Oregon’s easy-to-use carpool matching tool and trip planner.
- Public Service Loan Forgiveness (https://studentaid.gov/manage-loans/forgiveness-cancellation/public-service): You may qualify for the PSLF program.
- Hybrid Work Opportunity: This position supports a hybrid work schedule. You can expect to work in the office 1day per week, with work arrangements periodically reviewed to ensure business needs are met.

How to Apply

- Click on the "Apply" link above to complete your online application and submit by the posted closing date and time. For step-by-step instructions click apply to work for the state (https://www.oregon.gov/das/HR/Documents/Recruiting_ExternalCandidateApplication.pdf) or current state employee. (https://wd5.myworkday.com/oregon/d/task/1422$387.htmld) Only complete applications received by the deadline will be considered.
- Required Documents: cover letter and resume
- The work experience and/or education section of your application must clearly demonstrate how you meet all the minimum qualifications and desired skills and attributes listed above. Failing to attach required documents may result in disqualification of your application.
- The State of Oregon does not request or require your age, date of birth, attendance or graduation dates from an educational institution during the application process.

- Be sure to check Workday and your email for additional tasks and updates . After hitting submit there may be additional required tasks for you to complete prior to the announcement closing. Please save a copy of this job announcement for reference, as it is not available for you to view after the announcement deadline.

Additional Details

- This announcement is for one, full-time, permanent, SEIU represented, Security Analyst II – Threat Hunter (Information Systems Specialist 7) position and may be used to fill future vacancies.
- The salary listed is the non-PERS qualifying salary range. If the successful candidate is PERS qualifying, the salary range will reflect an additional 6.95%.Review the Classification and Compensation (https://apps.oregon.gov/das/classification-compensation) page for more details on the classification, or you may visit our website for information on the job offer process following pay equity (https://www.oregon.gov/das/hr/pages/equity.aspx).
- Applicants must be authorized to work in the United States. Applicants who require VISA sponsorship will not be considered at this time.
- Employee will be required to possess and maintain a valid driver’s license issued by the state where the employee resides.
- Employee is required to obtain and maintain CJIS clearance.
- Finalists will be subject to a computerized criminal history check. Adverse background data may be grounds for immediate disqualification.
- Eligible veterans and Oregon National Guard servicemembers (current and former) who meet the qualifications of the position will be awarded candidate preference. For more information, please visit Veterans Resources (http://www.oregon.gov/jobs/Pages/Veterans.aspx).  NOTE: If claiming preference please be sure to check your Workday account for pending tasks in the “My Tasks” section at the top of the Candidate Home page.
- For accommodation requests under the Americans with Disabilities Act (ADA), and application or Job-specific questions, please contact the Recruiter: Nancy Karnas [email protected] (mailto:[email protected])   | Phone: 971-719-3083.

Helpful Links & Resources

How to Set Job Alerts | Workday Applicant FAQ | What You Need to Know to Get the Job

Oregon Job Opportunities Webpage | Classification and Compensation | Pay Equity

The Department of Administrative Services is an Equal Opportunity, Affirmative Action Employer Committed to Workforce Diversity. At the Department of Administrative Services, we embody the value of hiring a workforce representative of the communities we serve, understanding that a diverse workforce revitalizes our state. We value diversity and foster a positive and welcoming environment where all employees can thrive.