TXCC - CTI Analyst (Cybersecurity Analyst III-IV)

Please paste the following URL into a browser to view the entire job posting on the CAPPS Careers page.https://erphcmprd.cpa.texas.gov/psp/candidateportal/EMPLOYEE/HRMS/c/HRS\_HRAM\_FL.HRS\_CG\_SEARCH\_FL.GBL?Page=HRS\_APP\_JBPST\_FLandAction=UandFOCUS=ApplicantandSiteId=1andJobOpeningId=107497andPostingSeq=1Agency InformationThe Texas Cyber Command (TXCC) is the state's front line of cyber defense, established by the 89th Texas Legislature to protect Texans, critical infrastructure, and government systems from evolving cyber threats. Headquartered in San Antonio (a national hub of cybersecurity talent), TXCC unites threat detection, incident response, and statewide cyber readiness under one mission-driven agency to establish Texas as the most cyber-resilient state in the nation. At TXCC, your work doesn't just sit in a queue - it actively secures, protects, defends, and educates over 31 million Texans every day.Job DescriptionThe Cyber Threat Intelligence Analyst performs advanced (senior-level) cybersecurity and information security analysis work, producing intelligence that informs Texas leadership, supports defenders across Texas Cyber Command, and enables collaboration with external partners. This role translates data, reporting, and technical findings into actionable intelligence that guides decision-making and strengthens cyber defense efforts. Operating under limited supervision with considerable latitude for initiative and independent judgment, the analyst works across strategic and technical domains and provides expert analysis to support the protection of state information systems and infrastructure.Essential Job DutiesIntelligence Creation and AnalysisResearches, develops, and produces intelligence products that inform cybersecurity operations and executive decision-making. Analyzes threat actors, campaigns, and tactics, techniques, and procedures (TTPs) relevant to Texas government and critical infrastructure. Translates geopolitical and operational developments into cyber risk assessments, including identification of likely adversary actions and sectors at elevated risk. Produces a range of intelligence products, including executive briefings, strategic warning, campaign analysis, actor profiles, sector-specific assessments, and incident-related reporting. Conducts in-depth analytic efforts to identify trends, recurring exploit paths, access patterns, and emerging threats requiring sustained attention. Intelligence Application and Operation SupportApplies cyber threat intelligence to support cybersecurity operations and organizational decision-making. Develops and disseminates indicators, detection logic, and contextual reporting to enable operational use by security teams. Supports active cybersecurity incidents by providing intelligence enrichment, attribution hypotheses, and contextual analysis to accelerate detection, response, and recovery efforts. Maintains a continuous feedback loop with security operations, incident response, and forensics teams to refine intelligence requirements and improve the effectiveness of intelligence products. Researches and analyzes cybersecurity threat indicators and behaviors to support the prevention, detection, containment, and mitigation of data security threats and incidents. Stakeholder Engagement and CommunicationEngages with executive leadership, partner agencies, and external stakeholders to communicate cyber threat intelligence and represent the organizations intelligence function. Presents intelligence findings through briefings, reports, and discussions tailored to technical and non-technical audiences. Supports interagency coordination and information sharing efforts. Promotes cybersecurity awareness by communicating relevant threat information and educating stakeholders on risks, trends, and best practices. Tradecraft, Innovation, and Continuous ImprovementMaintains and advances intelligence tradecraft, analytic rigor, and continuous improvement of intelligence processes Applies structured analytic techniques and ensures adherence to standards for sourcing, confidence assessment, and analytic integrity across all products. Leverages artificial intelligence and emerging technologies, including large language model tools, to enhance analytic workflows while exercising appropriate judgment regarding accuracy, reliability, and appropriate use. Identifies opportunities to improve methodologies, tools, and processes to increase the quality, efficiency, and impact of intelligence outputs.QualificationsMust meet applicable U.S. citizenship requirements, successfully complete required background screening, and maintain eligibility to access the systems, facilities, and information necessary to perform assigned duties. Must successfully complete and maintain applicable operational-readiness, incident-management, and other required training within established timeframes.Minimum QualificationsExperience:Cybersecurity Analyst III Five (5) years of experience in cyber threat intelligence, all-source intelligence analysis, or a closely related analytic discipline Cybersecurity Analyst IV Seven (7) years of experience in cyber threat intelligence, all-source intelligence analysis, or a closely related analytic discipline Required Experience for All LevelsDemonstrated experience producing written intelligence products for varied audiences, from executive leadership to technical defenders Working knowledge of adversary tradecraft, intrusion lifecycle concepts, and common analytic frameworks (e.g., MITRE ATTandCK, Diamond Model, kill chain) Familiarity with indicator types, detection logic, and the lifecycle of technical indicators from discovery to dissemination Ability to read and interpret technical artifacts (e.g., logs, network data, malware reports, vulnerability disclosures) to develop analytic judgments Experience using AI-assisted tools in an analytic workflowPreferred QualificationsExperience:Experience producing intell