Principal Information Security Analyst (Information Systems Analyst, Principal - Generalist)

Salary: $114,275.20 - $160,784.00 Annually
Location : Portland Building, 1120 SW 5th Ave, OR
Job Type: Regular
Remote Employment: Remote Only
Job Number:
Bureau: Bureau of Technology Services
Opening Date: 11/02/2026
Closing Date: 11/16/2026 11:59 PM Pacific

The Position
Job Appointment: Full Time, Regular
Work Schedule: Monday - Friday, 8:00 AM - 5:00 PM. Alternate schedules may be available.
Work Location: This position has an exception to work primarily remotely. However, there will be instances when it is necessary to come onsite for work (with as much advance notice as possible). Remote work must be performed within Oregon or Washington. For more information,
Union Representation: PROTEC17. To view current labor agreements, .
Starting Pay: The City of Portland follows the Your salary is determined based on the experience listed in your resume that is directly related and equivalent to the position for which you are applying.

Help protect the technology and critical infrastructure that Portland communities depend on every day.

The Bureau of Technology Services (BTS) is seeking two Principal Information Security Analysts to strengthen cybersecurity, reduce risk, and support reliable delivery of essential City services.

In this role, you will provide senior technical leadership across information technology (IT) and operational technology (OT) environments, including industrial control systems and supervisory control and data acquisition (ICS-SCADA) systems. You will translate complex security and compliance requirements into practical solutions that protect City information, support operational continuity, and improve cybersecurity maturity.

The two positions support the following service areas:

• Public Safety Service Area: Bureau of Emergency Communications, Portland Bureau of Emergency Management, Portland Fire & Rescue, and Portland Police Bureau.
• Public Works Service Area: Bureau of Environmental Services, Portland Parks & Recreation, Portland Bureau of Transportation, and Portland Water Bureau.

Both positions report to the Chief Information Security Officer (CISO) and work within a matrix reporting structure with their respective service area's senior managers. Assignments may emphasize enterprise security architecture and engineering or OT cybersecurity and critical infrastructure resilience, depending on program priorities and candidate strengths.

These positions work primarily remotely, with onsite attendance required for operational needs and cybersecurity incidents. Remote work must be performed within Oregon or Washington.
What You'll Do:

• Lead cybersecurity improvements: Assess current capabilities, identify security gaps, and develop measurable improvement plans across City IT and OT environments.
• Advise on security architecture: Guide technology teams and leadership on secure system design, cloud security, identity and access management, data protection, network security, and zero trust principles.
• Strengthen security operations: Develop and improve technical baselines, secure configurations, monitoring, alerting, vulnerability management, and operating procedures.
• Protect critical infrastructure: Partner with operational teams to address OT and ICS-SCADA risks, including network segmentation, secure remote access, vendor connectivity, monitoring, and recovery readiness.
• Assess and prioritize risk: Conduct or support threat modeling, risk assessments, control reviews, vulnerability assessments, penetration testing, and audits. Recommend practical remediation and investment priorities.
• Support governance and compliance: Align cybersecurity practices with City policies, applicable regulatory requirements, and recognized frameworks. Prepare documentation and evidence that support audits and compliance reviews.
• Integrate security into City projects: Participate in architecture reviews and help incorporate cybersecurity requirements into technology planning, procurement, implementation, and service operations.
• Support incident response: Assist with investigation, containment, recovery, and improvements following cybersecurity incidents.
• Build shared understanding: Explain technical findings and risks to diverse audiences, document recommendations and decisions, and support training and knowledge sharing across teams.

Ideal Candidate Profile:

• Experienced Technical Leader: Brings broad enterprise cybersecurity expertise and depth in security architecture, engineering, risk management, or OT security.
• Practical Problem Solver: Recommends security controls that balance risk, compliance, safety, operational continuity, and service delivery.
• Collaborative Partner: Builds trust across technical teams, bureau leadership, operational staff, vendors, and external partners. Can influence decisions across organizational boundaries.
• Clear Communicator: Creates useful technical documentation and translates complex cybersecurity issues into actionable recommendations for executives and nontechnical audiences.
• Continuous Improvement Focus: Works independently to assess capabilities, prioritize improvements, and demonstrate measurable progress.
• Critical Infrastructure Perspective: Understands the challenges of protecting essential services, including legacy systems, operational constraints, and recovery needs. Experience with OT/ICS-SCADA, NIST SP 800-82, or ISA/IEC 62443 is valuable.
• Public Service Commitment: Values equitable outcomes, responsible use of City resources, and reliable services for the community. Works effectively and respectfully in a culturally and gender-diverse workplace.

To Qualify
Please address and demonstrate, in your cover letter and resume, how your education, training, and/or experience meet each of the following minimum qualifications. Include specific examples describing the work you performed, your individual role, the tools or methodologies you used, and the results. Statements that you have the required experience, without supporting examples, do not provide enough information for reviewers to assess your qualifications:

1. Experience providing senior technical leadership in cybersecurity architecture, risk management, and compliance across complex enterprise technology environments, supported by relevant formal training, industry-recognized certifications, or equivalent professional experience.
2. Experience with cybersecurity frameworks and standards, including the NIST Cybersecurity Framework and relevant NIST Special Publications, and their application to security assessments, control design, and cybersecurity improvement planning.
3. Experience in enterprise security practices across networks, systems, applications, cloud platforms, operating systems, and virtualization, including identity and access management, zero trust principles, security hardening, and configuration management.
4. Experience evaluating or improving cybersecurity operations using tools and practices such as security information and event management (SIEM), endpoint detection and response (EDR), intrusion detection and prevention, firewalls, vulnerability management, and penetration testing.
5. Experience interpreting and supporting applicable regulatory requirements and cloud security controls, including documenting compliance, assessing control gaps, and recommending remediation priorities.
6. Experience analyzing complex cybersecurity issues, developing clear technical documentation and actionable recommendations, and communicating effectively with technical teams, leadership, and nontechnical partners to support collaborative decisions.

Additional Requirements: Selected candidates must pass a comprehensive background investigation, possess a valid Oregon or Washington driver's license, and be able to travel to City facilities when needed. Where equivalent experience is accepted in place of cybersecurity training or certifications, additional training and certifications
Preferred Qualifications:
These qualifications are not required but will be considered when evaluating applicants:

• Experience with operational technology (OT), industrial control systems (ICS), supervisory control and data acquisition (SCADA), and distributed control systems, including OT network architecture, segmentation, and the Purdue Model.
• Experience applying OT cybersecurity guidance, such as NIST SP 800-82 or ISA/IEC 62443, while addressing safety, availability, legacy systems, and operational continuity.
• Experience in use of industrial protocols, such as Modbus, DNP3, and OCP, and their cybersecurity considerations.
• Experience implementing OT monitoring, anomaly detection, secure remote access, vendor access controls, or incident response processes.
• Experience supporting architecture review boards, enterprise risk management, governance, risk, and compliance tools, or cybersecurity maturity programs.
• Experience working in government, utilities, healthcare, or other regulated or critical infrastructure environments.
• Experience developing cybersecurity strategies, architecture roadmaps, maturity models, or measurable improvement plans.
• Relevant cybersecurity certifications, such as CISSP, CISM, CISA, GIAC, CCSK, or comparable credentials. FEMA Incident Command System and National Incident Management System (ICS/NIMS) training is also valuable.

The Recruitment Process
How to Apply:

• Submit your resume and cover letter by the closing date.
• (Optional) Submit , if applicable.
  If this is your first time applying with the City of Portland, or if you haven't requested veteran preference before (and would like to now), please attach your DD214-Member 4 and/or VA Benefit Letter to your application. Once we verify your eligibility, we'll record your veteran preference in our system, so it automatically applies to your future applications.

What to Expect:

1. Application Review -Week of November 16, 2026: We'll review your application materials to ensure you meet the minimum qualifications listed above.

1. Notice/Feedback - Week of November 30, 2026: You will receive an email when the minimum qualification review is complete. If you disagree with the evaluation results, you may request a review within 14 days of the email notice, per

1. Selection Process - Mid-December: The hiring bureau will review qualified applications, conduct interviews, and check references.

1. Conditional Job Offer: Final candidates may undergo a background or driving record check, depending on the position.

Additional Information
Learn More About:

We're committed to providing a fair, inclusive, and accessible hiring process. If you need assistance with your application or would like to request a reasonable accommodation due to a disability, pregnancy, or religious belief, please contact the recruiter listed below.

Questions? We're here to help!
TroyLynn Craft, Senior Recruiter

Bureau of Human Resources
A Career with the City of Portland offers many Employee Benefits
We offer a comprehensive benefits package, including but not limited to

• Health Care (Medical, Vision and Dental)
• Carrot Fertility
• Wellness Benefits
• Life Insurance
• Long-term disability
• Employee Assistance Plan
• Flexible Spending Accounts
• Retirement
• Oregon Public Employees Retirement System (PERS), including contributions to the PERS IAP plan paid by employer
• Family Medical Leave
• City Paid Parental Leave

AND SO MANY MORE!

Benefits may vary depending on bargaining unit and employment status.
01

Thank you for your interest in the City of Portland. We value your time and hope to make your application experience as positive as possible.

Your Cover Letter and Resume are an important step to assist us in the review for minimum qualifications for the posted vacancy.
In your Cover Letter, specifically address how you meet each of the minimum qualification listed in the "To Qualify" section. The information you provide must correctly reflect your work history/resume. A lack of information in your application materials to each of the minimum qualifications may result in elimination from the recruitment.
Note: Request for veterans' preference, please add a copy of your DD214 and/or Veteran's Benefit letter. All documents must be uploaded by the closing date and time of this announcement.
Have you read and understood all the information listed above?

• No - If you have questions, please contact the recruiter on the announcement.
• Yes

02

Where did you first learn about this job opportunity? (If on a website or job board, please specify which one)
03

The City of Portland sometimes gets requests for public records. Please choose the response that best fits your preference:
(Your choice will not affect your application process.)

• I want my application to stay private. I understand that the City of Portland will keep my information confidential unless required to share it by law.
• I allow my application to be shared. I understand that by choosing this option, my information is no longer private.

04

For which position are you applying?

• Public Safety Service Area (PSSA)
• Public Works Service Area (PWSA)
• Both

Required Question