Cyber Intelligence Center- Cyber Incident Manager

San Bernardino County's Innovation and Technology Department (ITD) is seeking qualified and motivated professionals to serve as the Cyber Intelligence Center (CIC)- Cyber Incident Manager (CIM)*. The County’s CIC protects and monitors critical government services and systems in a highly regulated environment, residents’ data assets, and departmental operations. 

In this role, you will oversee countywide cybersecurity events and incidents from initial triage through recovery, lead daily CIC briefings to establish priorities, and coordinate a unified threat-informed response. 

The CIC CIM is a subject-matter expert responsible for:

• Managing and leading the County’s CIC staff in coordinating analysis, responses (e.g., Threat Modeling), containment/eradication, recovery, and post-incident activities of cybersecurity incidents.
• Knowledgeable in the selection and application of various threat models. 
• Coordinating activities across the County with affected departments’ leadership and technical teams, legal and privacy personnel, external partners, etc. 
• Overseeing the incident lifecycle, including detection, analysis, containment, evidence preservation, eradication, recovery, and post-incident improvements in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-61r3 and NIST Cybersecurity Framework 2.0.
• Monitoring incident response activities and service-level agreements with the County’s Managed Detection and Response (MDR) Services partner.
• Administer, support, and formulate relevant County / ITD policies, standard practices, and procedures.
• Lead, develop, and administer table-top exercises throughout the County / ITD as required. 
• Provide presentations, briefings, etc. as required to County and departmental leadership. 
• Ability to translate technical cyber information into layman’s terms for briefings, after-action reports, etc.
• Ability to identify, quantify, and maintain relevant incident response matrices, tracking Mean-Time-To-Respond (MTTR), etc. 
• Manage the County’s Security Information and Event Management (SIEM) environment that includes but not limited to the architecture, connectors, analytics, watchlists, workbooks, etc.
• Develop SIEM automation rules and logic app playbooks to codify containment and enrichment, integrating identity, endpoint, email, and network actions while preserving forensic evidence.
• Promoting ITD security cultural norms, including outcome-based execution, fact-based problem-solving, a sense of urgency, and collaboration.
• Managing, leading, and developing Information Security Analysts and other CIC team members.

• A bachelor’s degree in information security, computer science, business administration, public administration, or a related field, or equivalent experience
• Microsoft security stack (e.g., Defender, Sentinel, Entra ID), SIEM/EDR, and KQL-based analytics
• Excellence in executive and stakeholder communication; ability to produce briefings and after-action reports/reviews to formulate corrective actions plan.
• Ability to integrate external intelligence from but not limited to MS-ISAC, CISA, and CAL-CSIC, enrich indicators, and verify enforcement across County controls
• Must demonstrate strong, steady leadership in a high-stress, time-compressed environment, making clear decisions, communicating calmly, and guiding cross-functional teams to execute incident actions with urgency and discipline.

Examination Procedure: 

There will be a competitive evaluation of qualifications based on the information provided in the Application and the Supplemental Questionnaire. You are encouraged to include detailed descriptions of your qualifying experience and skills, as only the most highly qualified applicants will be referred to the Department.

Application Procedure: 

Please complete and submit the online employment application and supplemental questionnaire for consideration before 5:00 PM PST, FRIDAY, OCTOBER 30, 2026. Resumes will not be accepted in lieu of the application and/or supplemental questionnaires.

To ensure timely and successful submission of your online application, please allow ample time to complete and submit your application before the filing deadline. Applicants will be automatically logged-out if they have not submitted the application and all required materials prior to the posted deadline. Once your application has been successfully submitted you will receive an onscreen confirmation and an email. We recommend that you save and/or print these for your records. Please note: if you do not receive an onscreen confirmation and an email acknowledging our receipt of your application, we have not received your application. 

If you need technical assistance, follow this link to review the Government Jobs online application guide or contact their Toll-Free Applicant Support line at (855) 524-5627. Please note that Human Resources is not responsible for any issues or delays caused by your internet connection, computer, or browser when submitting an application.

Equal Employment Opportunity (EEO) / Americans with Disabilities Act (ADA):

San Bernardino County is an Equal Employment Opportunity (EEO) and Americans with Disabilities Act (ADA) compliant employer, dedicated to ensuring equal employment opportunities for all employees and applicants.

ADA Accommodation:

If you have a disability and need accommodations during the testing process, please submit the Special Testing Accommodations Request Form (Download PDF) within one week of the recruitment filing deadline.

Veterans' Preference:

Eligible veterans, their spouses, or widows/widowers who are not current County employees may receive additional Veterans' Preference points. For details and instructions on how to request these points, please refer to the Veterans' Preference Policy.

For more important details, review the Applicant Information and County Employment Process.