Security Analyst - Operational Technology

Job Description

JOB SUMMARY

Become part of a team that thrives on Professionalism, Innovation, Customer Experience, Integrity, and Teamwork — the values that guide how we serve our community.

The Security Analyst (Operational Technology) enhances the City’s overall cybersecurity resilience by safeguarding both information technology and operational technology systems, including Supervisory Control and Data Acquisition (SCADA) and industrial control environments supporting critical electric, water and wastewater operations. The role strengthens organizational security by implementing, monitoring, and improving cybersecurity controls, identifying and mitigating risks, and responding to evolving threats and incidents. Through collaboration with Operations and Information Technology (IT), the position advances cybersecurity maturity and ensures compliance with relevant standards and mandates. By integrating threat intelligence, vulnerability management, and regulatory oversight, this role helps protect essential City services and maintain the integrity, safety, and reliability of vital infrastructure.

ESSENTIAL FUNCTIONS

The following list highlights the main responsibilities of this position. While it covers the core tasks, it may not include every duty that could be assigned. Employees may be asked to take on other responsibilities as needed to support the team and department.

• • Maintains security systems and infrastructure to ensure the confidentiality, integrity, and availability of City technology environments, including provisioning, configuration, and ongoing operational support.
  • Monitors security systems, applications, and logs to identify potential threats; evaluates software versions, configurations, and vulnerabilities to support continuous security improvement.
  • Reviews vulnerability and risk assessments, evaluates the effectiveness of security controls, and recommends remediation strategies aligned with least-privilege and other security principles.
  • Maintains security policies, documentation, and reporting practices; ensures technical and procedural documentation remains accurate, complete, and up to date.
  • Reviews technology procurement and system changes for compliance with cybersecurity policies; ensures physical security technologies are configured, monitored, and aligned with organizational requirements.
  • Responds to cybersecurity incidents by analyzing events, assisting in containment and remediation, and leveraging threat intelligence to strengthen defensive posture.
  • Maintains and implements Operational Technology (OT) security controls in alignment with recognized standards and regulatory frameworks; monitors OT security alerts and passive-monitoring tools to identify threats.
  • Evaluates vulnerabilities in OT/ICS (Industrial Control Systems) and implements remediation activities to reduce operational risk while supporting safety, reliability, and uptime.
  • Maintains and updates OT Incident Response, Business Continuity, and Disaster Recovery plans; participates in tabletop exercises and participates in incident response activities involving OT environments.
  • Collaborate with Operations, Engineering, IT, Security Operations Center (SOC) partners, and vendors to align OT security practices with operational needs, including supporting secure remote access solutions.
  • Participates in OT risk assessments, threat modeling, compliance audits, and preparation of regulatory reports; maintains accurate inventories of OT/ICS assets and supports effective segmentation between IT and OT networks.
  • Assists with OT cybersecurity awareness training and evaluates emerging technologies, third-party security practices, and access controls to inform program improvements.
  • Conducts forensic analysis of OT-related incidents and documents findings, reports, and records to support transparency, compliance, and continuous improvement.
  • Performs other duties as assigned to advance the organization’s cybersecurity and operational resilience objectives.
  
  

SECURITY ANALYST II:

ADDITIONAL ESSENTIAL DUTIES AND RESPONSIBILITIES

In addition to Security Analyst I functions, the Security Analyst II:

• • Administers and maintains security systems and infrastructure to ensure the confidentiality, integrity, and availability of City technology environments, including provisioning, configuration, and ongoing operational support.
  • Configures security systems, applications, and logs to identify potential threats; evaluates software versions, configurations, and vulnerabilities to support continuous security improvement.
  • Conducts vulnerability and risk assessments, evaluates the effectiveness of security controls, and recommends remediation strategies aligned with least-privilege and other security principles.
  • Maintains security policies, documentation, and reporting practices; ensures technical and procedural documentation remains accurate, complete, and up to date.
  • Researches technology procurement and system changes for compliance with cybersecurity policies; ensures physical security technologies are configured, monitored, and aligned with organizational requirements.
  • Responds to cybersecurity incidents by analyzing events, coordinating containment and remediation, and leveraging threat intelligence to strengthen defensive posture.
  • Maintains and implements Operational Technology (OT) security controls in alignment with recognized standards and regulatory frameworks; monitors OT security alerts and passive-monitoring tools to identify threats.
  • Evaluates vulnerabilities in OT/ICS (Industrial Control Systems) and manages remediation activities to reduce operational risk while supporting safety, reliability, and uptime.
  • Maintains and updates OT Incident Response, Business Continuity, and Disaster Recovery plans; assists leading tabletop exercises and participates in incident response activities involving OT environments.
  • Collaborate with Operations, Engineering, IT, Security Operations Center (SOC) partners, and vendors to align OT security practices with operational needs, including administering secure remote access solutions.
  • Performs OT risk assessments, threat modeling, compliance audits, and preparation of regulatory reports; maintains accurate inventories of OT/ICS assets and configures effective segmentation between IT and OT networks.
  • Provides OT cybersecurity awareness training and evaluates emerging technologies, third-party security practices, and access controls to inform program improvements.
  • Conducts forensic analysis of OT-related incidents and documents findings, reports, and records to support transparency, compliance, and continuous improvement.
  • Performs other duties as assigned to advance the organization’s cybersecurity and operational resilience objectives.
  
  

SECURITY ANALYST III:
ADDITIONAL ESSENTIAL DUTIES AND RESPONSIBILITIES

In addition to Security Analyst II functions, the Security Analyst III:

• • Designs and maintains security systems and infrastructure to ensure the confidentiality, integrity, and availability of City technology environments, including provisioning, configuration, and ongoing operational support.
  • Designs security systems, applications, and logs to identify potential threats; evaluates software versions, configurations, and vulnerabilities to support continuous security improvement.
  • Designs vulnerability and risk assessments, evaluates the effectiveness of security controls, and manages remediation strategies aligned with least-privilege and other security principles.
  • Designs security policies, documentation, and reporting practices; ensures technical and procedural documentation remains accurate, complete, and up to date.
  • Assesses technology procurement and system changes for compliance with cybersecurity policies; ensures physical security technologies are configured, monitored, and aligned with organizational requirements.
  • Coordinates response to cybersecurity incidents by analyzing events, coordinating containment and remediation, and leveraging threat intelligence to strengthen defensive posture.
  • Manages and implements Operational Technology (OT) security controls in alignment with recognized standards and regulatory frameworks; monitors OT security alerts and passive-monitoring tools to identify threats.
  • Designs vulnerability assessments in OT/ICS (Industrial Control Systems) and implements remediation activities to reduce operational risk while supporting safety, reliability, and uptime.
  • Designs and updates OT Incident Response, Business Continuity, and Disaster Recovery plans; leads tabletop exercises and participates in incident response activities involving OT environments.
  • Collaborate with Operations, Engineering, IT, Security Operations Center (SOC) partners, and vendors to align OT security practices with operational needs, including designing secure remote access solutions.
  • Manages OT risk assessments, threat modeling, compliance audits, and preparation of regulatory reports; maintains accurate inventories of OT/ICS assets and supports effective segmentation between IT and OT networks.
  • Provides OT cybersecurity awareness training and evaluates emerging technologies, third-party security practices, and access controls to inform program improvements.
  • Leads forensic analysis of OT-related incidents and documents findings, reports, and records to support transparency, compliance, and continuous improvement.
  • Performs other duties as assigned to advance the organization’s cybersecurity and operational resilience objectives.
  
  

MINIMUM REQUIREMENTS & PREFERRED QUALIFICATIONS

MINIMUM REQUIREMENTS

• Bachelor’s degree in Computer Science, Information Technology, Cyber Security, Computer Systems Engineering, or a related technical field.? Additional work experience may substitute for a bachelor’s degree on a year-to-year basis.

• Two (2) or more years of experience in an information technology security role or similar position.

ADDITIONAL MINIMUM REQUIREMENTS
In addition to Security Analyst I functions, the Security Analyst II:

• Five (5) or more years of experience in an information technology security role or similar position.

ADDITIONAL MINIMUM REQUIREMENTS

In addition to Security Analyst II functions, the Security Analyst III:

• Seven (7) or more years of experience in an information technology security role or similar position.

PREFERRED QUALIFICATIONS

• Hands-on OT/ICS/SCADA experience preferred
• Security certifications will be considered but are not required.

• (ISC) 2 cyber security certifications

• CompTIA cyber security certifications

• ISACA cyber security certifications

• GIAC cyber security certifications

TRAINING/CERTIFICATIONS

• Must obtain ITIL Foundation certification within 1 year.
• Must obtain FEMA NIMS certifications within 1 year.

COMPETENCIES AND ENVIRONMENT

KNOWLEDGE, SKILLS, AND ABILITIES

• Knowledge of enterprise IT and OT architectures, including networks, applications, security solutions, ICS/SCADA environments, and related protocols.
• Knowledge of cybersecurity principles such as Zero Trust, identity and access management, encryption, configuration management, firewalls, DMZs, and secure remote access technologies.
• Knowledge of industry frameworks and regulatory guidance, including NIST SP 800 series, ISA/IEC 62443, American Water Works Association (AWWA) cybersecurity guidance, and U.S. Environmental Protection Agency (USEPA) expectations.
• Knowledge of security testing, evaluation methods, physical security systems, and network design considerations involving security and operational requirements.
• Skill in using cybersecurity, OT monitoring, and network analysis tools to identify threats, investigate incidents, and assess vulnerabilities.
• Skill in interpreting alerts from ICS-aware detection tools and Security Information and Event Management (SIEM) platforms, and in applying security control assessments aligned with relevant standards.
• Skill in technical troubleshooting, problem-solving, and performing forensic or evidence-based analysis across IT and OT systems.
• Skill in scripting or automation (e.g., Python, PowerShell) to support log analysis, reporting, and workflow efficiency.
• Ability to analyze complex security data, assess risk, and make sound decisions in dynamic or time-sensitive environments.
• Ability to communicate technical information clearly and collaborate effectively with internal departments, vendors, and partner organizations.
• Ability to manage time, maintain thoroughness, meet deadlines, and adjust to non-standard work hours when necessary.

PHYSICAL DEMANDS

This position requires the ability to lift up to 50 pounds occasionally. The physical requirements of the job include the ability sit, talk, kneel, bend at both the waist and knee, reach with the arms over the head, and hear, both on the telephone and in person, using regular conversational tones; vision requires the ability to focus and read printouts, computer, screens, and the written material, as well as, the ability of hand/finger usage to perform essential functions, such as computer typing.

WORK ENVIRONMENT

Work is primarily performed in an office setting with extended periods of sitting. Working conditions involve occasional exposure to variable and/or extreme weather conditions, diesel generators and/or other machinery with moving parts, working in confined spaces, and hazards associated with moving/lifting equipment and furniture is involved. Computer room is kept at 70 degrees and may be drafty. Noisy work environment, i.e. generators, alarms, and staff talking on phones (noises are intermittent and constant).

This is a safety-sensitive position.

The City of San Marcos offers its employees a broad range of benefits to enhance their personal and occupational lives. We are committed to a total rewards strategy that provides employees with competitive compensation, comprehensive benefits, and an environment that supports a healthy work/life balance.

View Our Benefits Guide.

BENEFITS
Medical, Dental & Vision Coverage

• United Healthcare
• Choice Plus PPO Plan
• Prescription Drug Plan
• Wellness Initiatives
• Virtual Doctor Visits 24/7
• Dental Plan
• Base Vision Plan
• Premium Vision Plan
• Laser Vision Correction discounts

Retirement

• Texas Municipal Retirement System (TMRS)
• Mission Square Retirement Corporation - optional 457-deferred compensation plan & Roth IRA

ADDITIONAL BENEFITS

• Flexible Spending Accounts
• City-paid Life and AD&D Insurance
• Voluntary Life, AD&D and Long-Term Disability insurance
• Employee Assistance Program
• Medical Concierge Service
• Vacation
• Sick Leave
• Holidays
• Longevity pay
• Tuition Reimbursement
• Activity Center Membership
• Direct Deposit
• Home Buyer Incentive Application
• Home Buyer Incentive Policy
• Paid Parental Leave
• Bereavement Leave

The City of San Marcos is committed to supporting a flexible and positive work/life balance. Certain eligible positions may offer remote telework opportunities based on departmental operations and the nature of the work. Telework is not a fully remote arrangement, and eligibility and frequency are determined by the department director based on operational needs and the city's commitment to providing quality services to the community.

Closing Date/Time: 11/13/2026 11:59 PM Central