Job Posting: Senior Cyber Defense Forensics Analyst

California Governor's Office of Emergency Services

JC-526526
-
Senior Cyber Defense Forensics Analyst
INFORMATION TECHNOLOGY SPECIALIST III

$9,507.00 - $12,740.00 per Month
New to State candidates will be hired into the minimum salary of the classification or minimum of alternate range when applicable.

Final Filing Date: 8/11/2026

Job Description and Duties

Secure California’s Future, Join the Cybersecurity Frontlines: Become a Senior Cyber Defense Forensics Analyst at the California Governor’s Office of Emergency Services
(Cal OES). From wildfires to major cyber incidents, California depends on skilled professionals to protect its critical infrastructure and public safety systems. At Cal OES, we are seeking experienced cybersecurity professionals to help defend the state’s digital environment and support California’s cyber resilience.

The California Cybersecurity Integration Center’s (Cal-CSIC) primary mission is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, critical infrastructure, or public and private sector networks. Cal-CSIC serves as the central organizing hub of state government’s cybersecurity activities and coordinates information sharing with local, state, and federal agencies, tribal governments, utilities, service providers, academic institutions, and nongovernmental organizations. Within Cal-CSIC, the Cyber Operations Branch program includes incident response, rapid response, threat identification, threat containment, threat eradication, security assessments, network perimeter vulnerability scanning, dark web review, net flow traffic analysis, endpoint detection and remediation support, and digital forensics services such as hard disk, memory, network, and malware analysis.

In this role as an Information Technology Specialist III (ITS III), Senior Cyber Defense Forensics Analyst, you will lead complex cyber incident response, digital forensic analysis, threat intelligence support, and multi-agency coordination efforts in support of Cal-CSIC’s mission. This position provides expert technical guidance to partner agencies and external organizations, develops after-action reviews and recommendations, delivers specialized training and briefings, and supports advanced cyber defense strategies and solutions.

Key responsibilities include:

  • Leading cyber incident response and forensic investigations for partner agencies and external organizations.
  • Providing expert technical guidance and support to multi-agency incident response teams.
  • Preparing after-action reviews, forensic reports, and recommendations for stakeholders.
  • Delivering training, briefings, and technical consultation to cybersecurity professionals and partner organizations.
  • Supporting the development and implementation of advanced cyber defense tools, monitoring strategies, and response capabilities.
  • Coordinating with state, local, tribal, federal, and private-sector partners to strengthen cyber defense and resilience.

To succeed in this position, you will need:

  • Significant experience in cyber incident response, digital forensics, or related cybersecurity functions.
  • Advanced knowledge of cybersecurity principles, threat analysis, and forensic methodologies.
  • Strong analytical, communication, and problem-solving skills.
  • Ability to lead complex investigations and collaborate across multiple agencies and organizations.
  • A commitment to protecting California’s critical infrastructure and public interests.

Joining Cal OES means working alongside dedicated professionals at the forefront of cybersecurity while contributing to the safety and security of Californians.

This position is located at our Mather Campus and is eligible for a hybrid work schedule which may include up to one day of remote work per week. Additional in-office days may be required based on business needs.

You will find additional information about the job in the Duty Statement.

Working Conditions

See duty statement for more information.

Minimum Requirements

You will find the Minimum Requirements in the Class Specification.

Additional Documents

Position Details

Job Code #:
JC-526526
Position #(s):
163-420-1415-006
Working Title:
Senior Cyber Defense Forensics Analyst
Classification:
INFORMATION TECHNOLOGY SPECIALIST III
$9,507.00 - $12,740.00

Effective July 1, 2025, CalHR implemented the temporary Personal Leave
Program 2025 (PLP 2025), which reduces employee pay in exchange for
leave credits. The reduction amount and leave credits vary by bargaining
unit. Salary range(s) listed do not reflect this temporary reduction.

New to State candidates will be hired into the minimum salary of the classification or minimum of alternate range when applicable.
# of Positions:
1
Work Location:
Sacramento County
Telework:
Hybrid
Job Type:
Permanent, Full Time

Department Information

The California Governor’s Office of Emergency Services (Cal OES) is committed to fostering a diverse and inclusive culture by hiring and retaining individuals from a variety of backgrounds and personal experiences. Our employees are empowered with the tools and resources necessary to meet our mission, while continuing to expand equity and inclusion efforts at all levels of the organization. We are committed to the spirit and work required to ensure the safety and resilience of every community in California.

Cal OES is an emergency response, homeland security, and disaster recovery agency and as a result, is a dynamic and exciting place to work in a team-oriented environment. Cal OES provides training to enhance the understanding of emergency and incident management to all employees.

Homeland Security is the coordinated effort to ensure we are prepared to prevent, protect against, mitigate, respond to and recover from threats and acts of terrorism, plus other man-made or natural disasters or catastrophes.  It requires a risk management process in order to ensure California has the right capabilities in place to manage those hazards that pose the greatest risk to the State, its people, and its critical infrastructure and key resources.

In the event of an emergency, employees may be contacted and requested to report to work in the event of an emergency. This contact may be outside of your normal working hours (evenings/nights, weekends, and holidays). This service may require irregular work hours, work locations other than the official duty location, and may include duties other than those specified in your official position description. Travel requirements in support of emergency operations may be extensive in nature (weeks to months), with little advance notice, and you may be required to relocate to emergency sites.

Department Website: http://www.caloes.ca.gov

Special Requirements

DMV Pull Program: Participation in the DMV Pull Program is required. The position(s) require(s) a valid Driver’s License (DL). You must answer the questions addressing your DL on your application. Ensure you provide your DL number, class, expiration date, and any endorsements and/or restrictions.

Conflict of Interest: This position is designated under the Conflict-of-Interest Code and is required to complete Form 700 within 30 days of appointment. Failure to comply with the Conflict-of-Interest Code requirements may void the appointment.

Homeland Security: This position requires access to National Security Information, and therefore, selected candidates must be able to obtain and maintain a Secret-level security clearance. Upon hire, candidates will be required to apply for the clearance, and once granted, they must maintain it as a condition of employment. Eligibility for a Department of Homeland Security (DHS) sponsored SECRET security clearance is also mandatory, and candidates must be able to qualify for and maintain it. To obtain a security clearance, you must be a U.S. citizen.

Application Package Requirements

To have your application considered for this job opportunity:

  • List the Job Code and Position Number for this position in the “EXAMINATION(S) OR JOB TITLE(S) FOR WHICH YOU ARE APPLYING” section on the State Application, STD. 678. 
  • List your most current employment history first in the “EMPLOYMENT HISTORY” section on the STD. 678. 
  • Provide the “From” and “To” dates with the month, day and year, the “Hours Per Week” that you worked and the Total Worked (Years/Months). You may include overtime hours.
  • You must complete the “DUTIES PERFORMED” on the State Application (do not note “see attached resume” in this section). Failure to comply and your application is considered incomplete.
  • SROA and Surplus are encouraged to apply and must submit a copy of their letter. 
  • Please note consideration shall be given to work experience gained in a part-time or full-time job, regardless of whether the job was a paid or a volunteer position or was within, or outside of, state service.

If using education to qualify please submit a copy of your transcripts. If selected, official transcripts will be required. Foreign education must obtain and submit verification of United States course/degree equivalency.

NOTE: Incomplete applications received may not be considered. Resumes are welcomed but do not take the place of the completed State Application STD 678. Applications received via fax or email will NOT be accepted. If you would like confirmation of receipt, please send certified mail.

**A candidate pool may be established for subsequent vacancies.**
**All hires may be subject to a criminal background check.**
**We encourage applicants to apply electronically.**

Application Instructions

Completed applications and all required documents must be received or postmarked by the Final Filing Date in order to be considered. Dates printed on Mobile Bar Codes, such as the Quick Response (QR) Codes available at the USPS, are not considered Postmark dates for the purpose of determining timely filing of an application.

Final Filing Date: 8/11/2026

Who May Apply

Individuals who are currently in the classification, eligible for lateral transfer, eligible for reinstatement, have list or LEAP eligibility, are in the process of obtaining list eligibility, or have SROA and/or Surplus eligibility (please attach your letter, if available). SROA and Surplus candidates are given priority; therefore, individuals with other eligibility may be considered in the event no SROA or Surplus candidates apply. Individuals who are eligible for a Training and Development assignment may also be considered for this position(s).

Applications will be screened and only the most qualified applicants will be selected to move forward in the selection process. Applicants must meet the Minimum Qualifications stated in the Classification Specification(s).

How To Apply

Complete Application Packages (including your Examination/Employment Application (STD 678) and applicable or required documents) must be submitted to apply for this Job Posting. Application Packages may be submitted electronically through your CalCareer Account at www.CalCareers.ca.gov. When submitting your application in hard copy, a completed copy of the Application Package listing must be included. If you choose to not apply electronically, a hard copy application package may be submitted through an alternative method listed below:

Address for Mailing Application Packages

You may submit your application and any applicable or required documents to:

California Governor's Office of Emergency Services
Recruitment
Attn: Human Resources
3650 Schriever Ave
Mather, CA 95655

Address for Drop-Off Application Packages

You may drop off your application and any applicable or required documents at:

California Governor's Office of Emergency Services
Human Resources
HR Unit - HS
10370 Peter A McCuen Boulevard
Mather, CA 95655
Please drop off at HR Window; Second Floor. This excludes holidays and weekends.
08:00 AM - 05:00 PM

Required Application Package Documents

The following items are required to be submitted with your application. Applicants who do not submit the required items timely may not be considered for this job:

  • Current version of the State Examination/Employment Application STD Form 678 (when not applying electronically), or the Electronic State Employment Application through your Applicant Account at www.CalCareers.ca.gov. All Experience and Education relating to the Minimum Qualifications listed on the Classification Specification should be included to demonstrate how you meet the Minimum Qualifications for the position.
  • Resume is required and must be included.
  • Statement of Qualifications - Please refer to the Statement of Qualifications (SOQ) section at the bottom of this job bulletin for the filing instructions and the SOQ Question(s). Applications submitted without the SOQ may not be considered.
Applicants requiring reasonable accommodations for the hiring interview process must request the necessary accommodations if scheduled for a hiring interview. The request should be made at the time of contact to schedule the interview. Questions regarding reasonable accommodations may be directed to the EEO contact listed on this job posting.

Desirable Qualifications

In addition to evaluating each candidate's relative ability, as demonstrated by quality and breadth of experience, the following factors will provide the basis for competitively evaluating each candidate:

  • Ability to analyze advanced malware, threats, and complex vulnerabilities.
  • Ability to lead vulnerability assessments, interpret scan results, and recommend remediation strategies.
  • Ability to analyze network traffic and packet data using diagnostic tools such as ping, traceroute, nslookup, and protocol analyzers.
  • Ability to detect, assess, and coordinate response to host and network intrusions using IDS/IPS technologies.
  • Ability to apply cybersecurity, privacy, and risk principles to enterprise requirements.
  • Ability to document, validate, and source intelligence and assessment data accurately and completely.
  • Skill in developing and deploying signatures, countermeasures, and incident response methods.
  • Skill in evaluating security architecture, control effectiveness, and system resilience.
  • Skill in identifying vulnerabilities, attack patterns, and adversarial techniques.
  • Skill in assessing security designs and controls using recognized standards and frameworks.
  • Skill in performing advanced traffic, packet, and trend analysis.
  • Skill in advising on cyber defense reporting, escalation, and coordination processes.
  • Knowledge of enterprise networking, protocols, and security architecture.
  • Knowledge of cyber threats, vulnerability management, and incident response.
  • Knowledge of authentication, access control, identity management, and cryptography.
  • Knowledge of operating systems, hardening methods, and system security testing.
  • Knowledge of applicable cybersecurity laws, policies, and data protection standards.
  • Knowledge of penetration testing, vulnerability tools, and emerging cyber defense technologies.
  • Highly desired: GIAC Security Essentials (GSEC) or equivalent industry-recognized certification, such as ISC2 SSCP.
  • Additional desirable certifications: GIAC Certified Enterprise Defender (GCED), GIAC Certified Intrusion Analyst (GCIA), and GIAC Continuous Monitoring (GMON), or equivalent.

Benefits

Cal OES employees are eligible for a number of benefits and working for us is a great opportunity to join a committed team. Benefits include but are not limited to the following:
  • Free Parking
  • On-site Gym and Locker room
  • Electric Carport
  • Excellent CalPERS state pension plan
  • 401(k) and 457(b) Plans
  • Flexible Schedules
  • Generous paid time off
  • Health, dental & vision insurance for the employee or the employee's family
  • Investment in careers development
  • Located near many local eateries, financial institutions, and the Light Rail Station
Benefit information can be found on the CalHR website and the CalPERS website.

Contact Information

The Human Resources Contact is available to answer questions regarding the position or application process.

Department Website: http://www.caloes.ca.gov
Human Resources Contact:
Recruitments
(916) 845-8321
Recruitments@CalOES.ca.gov

Please direct requests for Reasonable Accommodations to the interview scheduler at the time the interview is being scheduled. You may direct any additional questions regarding Reasonable Accommodations or Equal Employment Opportunity for this position(s) to the Department's EEO Office.

EEO Contact:
EEO Officer
(916) 845-8600
EEO@CalOES.ca.gov
California Relay Service: 1-800-735-2929 (TTY), 1-800-735-2922 (Voice) TTY is a Telecommunications Device for the Deaf, and is reachable only from phones equipped with a TTY Device.

Statement of Qualifications

All applicants must provide a Statement of Qualifications (SOQ) for the hiring manager’s review. Failure to include an SOQ may disqualify an applicant from consideration. Your SOQ will be a determining factor of your qualifications for this position. If your qualifications are competitive, you will proceed to the hiring interview. 

A resume in lieu of the SOQ responses may disqualify an applicant from consideration. A standard or generic SOQ may disqualify an applicant from consideration. 

Please review the Duty Statement for the position. 

The SOQ should be no more than two pages, single-spaced in 12-point Arial font.  

Please respond to the following prompts, providing detailed examples and explanations where appropriate.  

  • Provide an example of a time when you performed or identified a cybersecurity issue and remediated the issue.
  • Provide an example of the incident response lifecycle with regards to a cybersecurity incident you were involved in.
  • Of all the trainings available for cybersecurity incident response which do you find most beneficial and why?

Looking for guidance on navigating the state's job board or need assistance with uploading your documents or SOQ? Check out helpful how-to videos here: Work4CA: How to Get a State Job Series - YouTube to make your job search easier and more effective!

Examination Information

To gain list eligibility for this position, please take the required exam by using the following link: Information Technology Specialist III - Exam 1752.

Equal Opportunity Employer

The State of California is an equal opportunity employer to all, regardless of age, ancestry, color, disability (mental and physical), exercising the right to family care and medical leave, gender, gender expression, gender identity, genetic information, marital status, medical condition, military or veteran status, national origin, political affiliation, race, religious creed, sex (includes pregnancy, childbirth, breastfeeding and related medical conditions), and sexual orientation.

It is an objective of the State of California to achieve a drug-free work place. Any applicant for state employment will be expected to behave in accordance with this objective because the use of illegal drugs is inconsistent with the law of the State, the rules governing Civil Service, and the special trust placed in public servants.

Application Methods:
Electronic (Using your CalCareer Account)
By Mail
Drop-off
Print Job