Cyber Security Analyst (Remote From Anywhere In CO)

Salary: $115,000.00 - $125,000.00 Annually
Location : Statewide, CO
Job Type: Full Time
Job Number: EGB93898
Department: Governor's Office of Information Technology
Opening Date: 11/09/2026
Closing Date: 11/16/2026 11:59 PM Mountain
FLSA: Determined by Position
Primary Physical Work Address: (Remote From Anywhere In CO)
FLSA Status: Exempt; position is not eligible for overtime compensation.
Department Contact Information:
Type of Announcement: This announcement is not governed by the selection processes of the classified personnel system. Applications will be considered from residents and non-residents of Colorado.
How To Apply: Please submit an online application for this position at https://www.governmentjobs.com/careers/colorado. Reach out to the Department Contact to apply using a paper application, including any supplemental questions. Failure to submit a complete and timely application may result in the rejection of your application. Applicants are responsible for ensuring that application materials are received by the appropriate Human Resources office before the closing date and time listed.

Description of Job
IMPORTANT NOTE: Please review your application to ensure completion. For the most equitable applicant experience, OIT's hiring team considers only the contents of your application to review your qualifications. Please do not include any attachments (such as resume or cover letter) with your application as these items are not used by OIT's hiring team.
Are you looking for a fulfilling career that capitalizes on your passion for cybersecurity? Do you want to engage in challenging work where you can protect Coloradans' privacy and livelihood?

Join the Colorado Governor's Office of Information Technology (OIT) as a Cyber Security Analyst within our Chief Information Security Office (ISO). As a member of the Security Operations Center, you'll collaborate with team members to identify and respond to cyber threats facing state systems, investigate security alerts, and contribute valuable insights that support our insider threat monitoring program.
You will apply established playbooks and procedures to resolve issues rather than setting response strategy independently, ensuring that the most complex, novel, or high-severity incidents are seamlessly handed up to the Senior Cyber Security Analyst (Tier 3) or ISO Leadership for advanced handling.
Essential Functions:

Incident Investigation & Response

• Investigate assigned or escalated security alerts using SIEM/EDR and related tooling; determine scope and likely root cause using established procedures.
• Execute containment and remediation steps per existing playbook. Escalate to the Senior Cyber Security Analyst when a playbook doesn't cover the scenario or the incident meets or exceeds the established severity thresholds.

Insider Threat Monitoring Support

• Monitor alerts generated by the insider threat detection tooling; flag anomalous user activity or access patterns for the Senior Analyst's review.

Incident Documentation

• Document investigation steps, findings, and actions taken in the case management system, in enough detail for the Senior Analyst's after-action review and periodic reporting to draw on - this role doesn't own that reporting, just feeds it.

Depth of accountability

• Decides independently: which playbook applies to a given alert; triage priority within assigned caseload; routine tool usage.
• Escalates: anything outside playbook coverage, anything at or above the defined severity threshold, and any decision that would commit OIT to a leadership-facing action.

Forensic & Malware Triage Support

• Collect and preserve evidence from compromised systems in a forensically sound manner, under the Senior Analyst's direction, following the NIST SP 800-86 chain-of-custody discipline.
• Perform first-pass malware and artifact triage - checking samples against known-bad indicators and threat intelligence using established tools - and hand off anything requiring deeper reverse-engineering to a Senior Analyst.

Minimum Qualifications, Substitutions, Conditions of Employment & Appeal Rights

A wide salary range is posted for this position and any job offer is based upon a salary analysis to comply with the Colorado Equal Pay for Equal Work Act. The salary analysis considers relevant experience, education, certifications, and state seniority as compared to others doing substantially similar work. While all offers are compliant with the Colorado Equal Pay for Equal Work Act, there is no guarantee an offer will be at the top of the posted range based on the salary analysis.

This is a skills-based job announcement. The required minimum qualifications and/or education (if substituting for the proven experience, knowledge, and skills), are as follows:
Minimum Qualifications:
A minimum of three (3) years of professional experience in the Information Technology field with an emphasis on event examination and incident response.
Substitutions:

• Additional appropriate education will substitute for the required experience on a year-for-year basis, but cannot completely substitute for these qualifications.
• Training or Certification related to the work assigned to the position will be assigned credit towards substitution for experience and/or education, but cannot completely substitute for these qualifications.

Preferred Qualifications:

• Demonstrated Experience in performing computer forensic examinations, reporting, and remediation recommendations.
• Understanding of industry best practices in cyber incident response processes and a proven track record of executing them.
• Experience in developing, documenting, and maintaining security procedures.
• Knowledge of enterprise infrastructure, including servers, cloud infrastructures, routers, switches, firewalls, and associated protocols.
• Professional certifications such as CompTIA Security+, CISSP, GSEC, CEH, or other equivalent credentials from recognized standards bodies.

Conditions of Employment:
OIT employees must comply with any screening procedures in place at state agency locations where they might perform work.

A pre-employment background check will be conducted as part of the selection process. Post-employment background checks will be required for specific agencies as business needs dictate, which may include a polygraph exam, fingerprint-based criminal history search, reference checks, and a drug test.

This position may require travel within the specified geographic area, and to locations across the state as needed.

Supplemental Information
If this posting indicates "remote from anywhere in CO" in the title, periodic reporting to the primary state work location designated for the position is required. All remote work must be performed in Colorado.

While candidates from out of state will be considered for this role, the candidate selected for the position must relocate and reside in Colorado on the first day of their new position. A reasonable timeframe for relocation will be established on an individual basis, while considering business needs, and determining a start date.
We know it's important to support each other, and that means having a healthy balance of work and personal time. Visit our benefits to learn more about some of our great offerings that allow us all to have fulfilling lives.

Visit our How to Apply webpage to learn more about our application process and what to expect after you apply.