Cyber Technical Intelligence Analyst

Job Description The NYC Department of Buildings (DOB) is responsible for ensuring the safe and lawful use of buildings and properties by enforcing the NYC Construction Codes, Energy Code and Zoning Resolution. We facilitate compliant development with integrity, efficiency and professionalism. DOB is committed to becoming a premier municipal building organization, dedicated to enhancing the quality of life for all New Yorkers and making our city safer. We are committed to improving our performance and developing procedures that are streamlined, understandable and transparent. We are seeking a Cyber Technical Intelligence Analyst. Cyber Technical Intelligence Analyst will perform critical functions within the Threat Management discipline by consuming and analyzing tactical and technical intel, as well as coordinating between New York City Cyber Command and Office of Technology & Innovation Info Sec. Duties and Responsibilities include but not limited to the following: - Provide intel support and directly assist or execute investigative efforts or tasks; - Assist hunt missions to augment detection capabilities to identify threats across DOB’s IT operating environment; - Responsible for the collection, processing, analysis, and dissemination of tactical intelligence (IOC’s) and products (finished reports) - Develop, maintain, and execute threat and risk communication processes - Perform network, system, and kill chain analysis on how malware was introduced and propagated; - Conduct research for tracking certain code families, campaigns, or actors through technical analysis of data, malicious codes, and infrastructure; - Employ predictive analytic methods to determine changes in adversary’s capabilities, motivations, and intent, while providing recommendations to reduce risk before exposure to threats occur; - Characterize and analyze network traffic and server/cloud performance metrics to identify anomalous activity and potential threats; - Resolve New York City Cyber Command’s Security Operations Center remediation requests - Provide direct analytic support, threat hunting, detection engineering to the Security Operations Center, including Incident Response and Risk Analysts, to add context to active investigations and threats using intelligence; - Follow up on incident reports and app scan reports to ensure that proper mitigation is taking place in timely manner; - Investigate suspicious traffic and identify potential attacks, false positives, and missed detections - Conduct network monitoring and intrusion detection analysis using various computer network defense tools, such as intrusion detection/prevention systems, firewalls and host-based security systems; review and adjust ACL as needed based on source/destination/port by requirement; - Conduct log-based and endpoint-based threat detection to detect and protect against threats coming from multiple sources; - Correlate activity across assets (endpoint, network, apps) and environments (on-premises, cloud) to identify patterns of anomalous or suspicious activity; - Support the creation of business continuity/disaster recovery plans, including conducting disaster recovery tests, publishing test results and making changes necessary to address deficiencies; - Research emerging threats and vulnerabilities to aid in the identification of incidents; - Provide users with incident response support, including mitigating actions to contain activity and facilitating forensic analysis when necessary; - Design, implement, audit, and maintain ThreatLocker policies - Manage ThreatLocker Application Whitelisting, Ringfencing, Storage Control, and Elevation Control - Use scripting and automation tools, including PowerShell, Python, Power Automate, and Microsoft Graph API, to improve mobile service capabilities. - Subject matter expert in mobile (MDM) architecture, device management, and security. - Create and present custom threat briefing materials for tactical situational awareness; - Handle special projects and initiatives as assigned. REMOTE WORK This position may be eligible for remote work up to 2 days per week, pursuant to the Remote Work Pilot Program. To Apply: Visit Jobs NYC (cityjobs.nyc.gov) to view and apply for available positions. Search by agency (Department of Buildings), keywords, or for the specific Job ID #. NOTE: ONLY THOSE CANDIDATES UNDER CONSIDERATION WILL BE CONTACTED. IT SECURITY SPECIALIST - 95622 Minimum Qualifications A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or, Education and/or experience which is equivalent to "1" above. Preferred Skills The preferred candidate should possess the following: - Experience working in a security environment and/or supporting security teams from a technical standpoint - In-depth knowledge of the current cyber threat landscape, with a specific focus on the technical aspects of adversarial Tactics, Techniques and Procedures (TTPs) and their relation to the cyber kill chain and other analytical models - Fundamental analytic tradecraft skill sets, with extensive experience in the extraction and analysis of tactical intelligence from investigations - Lead complex cybersecurity incidents from identification through containment, eradication, recovery, and post-incident review. - Act as the primary escalation point for L1 and L2 to New York City Cyber Command’s Security Operations Center - Perform advanced threat hunting using Microsoft Defender XDR, Microsoft Sentinel, KQL, and other telemetry sources. - Conduct root cause analysis and recommend improvements to detection and response capabilities. - Produce clear incident reports, threat briefings, and stakeholder communications. - Support purple-team exercises, attack simulations, and MITRE ATT&CK-aligned threat modelling activities. - Detection Engineering & SOC Optimization - Support automation initiatives using Logic Apps, SOAR workflows, PowerShell, and other tooling where appropriate. Public Service Loan Forgiveness As a prospective employee of the City of New York, you may be eligible for federal loan forgiveness programs and state repayment assistance programs. For more information, please visit the U.S. Department of Education’s website at https://studentaid.gov/pslf/. Residency Requirement New York City Residency is not required for this position Additional Information The City of New York is an inclusive equal opportunity employer committed to recruiting and retaining a diverse workforce and providing a work environment that is free from discrimination and harassment based upon any legally protected status or protected characteristic, including but not limited to an individual's sex, race, color, ethnicity, national origin, age, religion, disability, sexual orientation, veteran status, gender identity, or pregnancy.