OAG - Entp Information Security | Cybersecurity An

ATTORNEY GENERAL OF TEXAS • Austin, TX • 2h ago

Please paste the following URL into a browser to view the entire job posting on the CAPPS Careers page.https://erphcmprd.cpa.texas.gov/psp/candidateportal/EMPLOYEE/HRMS/c/HRSHRAMFL.HRSCGSEARCHFL.GBL?Page=HRSAPPJBPSTFLandAction=UandFOCUS=ApplicantandSiteId=1andJobOpeningId=102653andPostingSeq=1Job DescriptionGENERAL DESCRIPTIONThe Office of the Attorney General (OAG) is seeking a senior-level AI Cyber Automation Engineer / Tier 3 SOC Analyst to strengthen detection, response, and orchestration capabilities across the agency's security operations. This role blends deep SOC investigative expertise with hands-on security automation engineering, focusing on CrowdStrike Falcon and Torq to build scalable, AI-assisted detection and response workflows. The ideal candidate has practical experience integrating large language model (LLM) tools such as Claude into security operations, for triage acceleration, playbook generation, and analyst augmentation, while operating within a strict Zero Trust, defense-in-depth security posture appropriate to a state Attorney General's office. This position operates in an environment governed by IRS Publication 1075 (FTI), FBI CJIS Security Policy, and Texas Government Code requirements.The Office of the Attorney General is a dynamic organization with over 4,000 employees throughout the State of Texas. Our agency provides exemplary legal representation for every arm of the State, fights human trafficking, helps victims of crime, protects our constituents, and runs the most effective Medicaid Fraud Control and Child Support Enforcement programs in the nation. OAG employees enjoy excellent benefits (http://ers.texas.gov/Benefits-at-a-Glance) along with tremendous opportunities to do important work at a large, dynamic state agency making a positive difference in the lives of Texans.ESSENTIAL POSITION FUNCTIONSServe as a SOC analysis and Tier 3 escalation point for complex security incidents, performing deep-dive investigation, root cause analysis, and threat hunting across endpoint, network, cloud, and identity telemetry.Design, build, and maintain detection analytics, dashboards, and hunting queries (Falcon Query Language / FQL) within CrowdStrike Falcon, tuning correlation rules and detection logic to reduce false positives and improve mean-time-to-detect (MTTD). Architect and maintain security orchestration, automation, and response (SOAR) playbooks in Torq, integrating Sentinel, EDR, identity providers, ticketing, and communication platforms into automated response workflows.Design AI-assisted analyst workflows (e.g., automated triage summarization, alert enrichment, playbook drafting) using approved generative AI tooling, ensuring all inputs are sanitized and free of regulated or case-specific data.Lead incident response efforts for high-severity events, coordinating with IT, legal, and divisional stakeholders whilestrictly adhering to FTI/CJI handling restrictions.Develop and maintain detection engineering documentation, runbooks, and standard operating procedures (SOPs) for Tier 1/Tier 2 analyst use. Mentor and provide technical guidance to Tier 1 and Tier 2 SOC analysts; review and validate their investigative work and escalation quality.Continuously evaluate and integrate emerging SOC automation and AI capabilities, presenting proposals for tooling changes with documented risk and compliance analysis.Participate in an on-call rotation for critical incident escalations. May require after-hours availability for critical incident response.Subject to session logging, audit review, and monitoring in accordance with Texas Government Code and applicable federal security requirements.Performs related work as assigned.Maintains relevant knowledge necessary to perform essential job functions.Attends work regularly in compliance with agreed-upon work schedule. Telework schedules are permitted for employees based on the agencys approved Telework Plan, if schedule does not adversely affect operationsand service levels, and standard hours of operation are maintained.Ensures security and confidentiality of sensitive and/or protected information.Complies with all agency policies and procedures, including those pertaining to ethics and integrity. MINIMUM QUALIFICATIONSEducation: Graduation from high school or equivalentExperience: Nine years of full-time experience in progressive SOC / security operations experience, including 2 years as functioning at a Tier 3 / senior analyst or detection engineering level; may substitute credit hours from an accredited college or university for the required experience on a year-for-year basisHands-on production experience with CrowdStrike Falcon (Insight XDR, Discover, and/or Fusion SOAR), including custom detection/IOA authoring, Falcon Query Language (FQL) use, and dashboard development. Demonstrated experience building or maintaining SOAR automation (Torq strongly preferred)Solid understanding of the MITRE ATTandCK framework, incident response lifecycle, and threat intelligence integration.Practical, hands-on experience using AI/LLM tools (e.g., Claude, GPT-based tools) to support security operations, with clear understanding of data sanitization and safe-use boundaries in a regulated environment.Working knowledge of Zero Trust architecture principles (NIST 800-207) and general familiarity with regulatory frameworks such as IRS Pub. 1075, FBI CJIS Policy, and HIPAA.Strong scripting/automation ability (PowerShell, Python, or Falcon Query Language-based automation) for building custom detections and integrations. Excellent written communication skills for incident reporting, runbook authorship, and cross-divisional coordination.Ability to obtain and maintain a Texas state government background clearance.Skill in exercising sound judgment and effective decision making.Skill in effective oral and written communication.Ability to handle multiple tasks, prioritize, and meet deadlines.Ability to gather, assemble, correlate, and analyze f

Go to Apply

AI-Enabled Solution Architect - Capture & Proposal Support (Entry-Level Architect)

Amentum • Austin, TX • 1d ago

IT & Engineering

Amentum's Engineering & Technology (E&T) organization is expanding its capacity to pursue increasingly complex Department of War (DoW) opportunities across a broad portfolio. Historically, dedicated solution arch...

1d ago

Go to Apply

Mechanical Engineer, Infrastructure

Meta • Austin, TX • 1d ago

IT & Engineering

Summary: This is a full-time position within the Mechanical Engineering group. The Mechanical Engineering group supports all the Data Center product teams, such as AI/ML servers, storage, networking, racks, connectivity,...

1d ago

Go to Apply

Subscribe to get new jobs sent directly to you
(no charge, cancel anytime)