Security Operations Center Analyst - Level I (IT Service Specialist) - ITS Department

The City of Phoenix, Information Technology Services Department (ITS) provides enterprise-wide IT and supports departments' business solutions. Our business is in the City of Phoenix, which means the work our IT professionals do helps to improve lives of residents, businesses, and visitors to Phoenix!

The ITS Department is seeking a detail oriented and highly motivated Security Operations Center (SOC) Analyst to join the cybersecurity team. In this role, you will be responsible for monitoring, investigating, and responding to security events across the enterprise environment.

Responsibilities include:

• Monitor and analyze security alerts from SIEM, endpoint protection platforms, and network security tools to identify potential threats.
• Perform triage, analysis, and escalation of security events based on established procedures.
• Support incident response activities, including investigation, containment, and documentation.
• Investigate suspicious activity and coordinate response efforts with cross-functional teams.
• Document findings, generate incident reports, and update SOC playbooks and runbooks.
• Collaborate with ITS, Infrastructure, and Cybersecurity teams to remediate identified threats.
• Maintain operational readiness of SOC tools, dashboards, and monitoring systems.
• Stay current with emerging security threats, vulnerabilities, and mitigation techniques.

This position will be funded through June 2027 with a possibility to be made regular in a future budget cycle. The temporary position will have benefits but will not earn city retirement credits or participate financially into the city's retirement program. If the successful candidate is a current City employee, all benefits will still be applicable, and the employee will still contribute to their pension. Temporary positions are not covered under civil service rules, and thus employment is considered "at-will", and employees may be separated at any time.

• Knowledge of incident response processes and cybersecurity best practices.
• Strong analytical, troubleshooting, and communication skills.
• Strong understanding of MITRE ATT&CK mapping, detection engineering, and continuous SIEM optimization.
• Ability to work independently and in a team environment.
• Skilled in creating and tuning correlation rules, alerts, threat detection use cases, and dashboards to reduce false positives and improve incident response efficiency.

Pay Range: $67,849.60 to $95,451.20 annually.

Hiring Range: $67.849.60 to $86,590.40 annually.

Pay Range Explanation:

• Pay range is the entire compensation range for the position classification.
• Hiring range is an estimate of where you can receive an offer. The actual salary offer will carefully consider a wide range of factors, including your skills, qualifications, experience, education, licenses, training, and internal equity.

Internal Only: Please understand that this is pay grade 054. If selected, your salary offer will be based on the applicable promotion or demotion worksheet in accordance with the City Pay Ordinance.

• Promotions occur when the last two digits of the pay grade increase.
• Demotions occur when the last two digits of the pay grade decrease.
• Lateral transfers occur when there is no change to the last two digits of the pay grade.
• When there is a change in the first digit of the pay grade, there may also be a change to your classification or unit.

Your job classification can be found in eCHRIS > Personal Details under your name, located in the top left section of the page.

The pay grade and classification/unit of your current position may be found by looking up your job title on the job description page.

A comprehensive benefits package is offered which includes:

• for more details: Pension Information
• 401(a) and 457 plans with employer contributions
• Choice of generous medical HMO, PPO, or HSA/HDHP plans
• Medical enrollment includes a monthly $150 City contribution to a Post-Employment Health Plan
• Wellness incentive of up to $720 annually
• Dental, vision, and life insurance options
• Employer paid long-term disability
• Free Bus/light rail pass
• Tuition reimbursement program up to $6,500 per year
• Paid time off includes 13.5 paid holidays, 12 vacation days, and 15 sick days and personal leave days
• Paid Parental Leave for eligible employees up to 480 hours (12 weeks) of paid leave for the birth, adoption, or foster care placement of a child during a 12-month period
• Federal Student Loan Forgiveness offered through Savi

For more details, visit: Unit 007 Benefits

• One year of experience using information technology desktop tools, business applications, and/or performing systems analysis.
  • Or completion of a designated training program, or graduation from a recognized technical/programming school or junior college.
• One year experience in customer service.
• Other combinations of experience and education that meet the minimum requirements may be substituted.
• All finalists for positions are subject to a criminal background check applicable to the department or position.
• This position is subject to Criminal Justice Information Systems (CJIS) background standards. Candidates who receive a conditional offer of employment must be fingerprinted and will have their fingerprints used to check the Criminal History Records of the State of Arizona Department of Public Safety and the Federal Bureau of Investigation. Any records returned will be reviewed to determine the candidate's suitability for the job. (ITS positions that require CJIS checks).
• Some positions require the use of personal or City vehicles on City business. Individuals must be physically capable of operating the vehicles safely, possess a valid driver's license and have an acceptable driving record. Use of a personal vehicle for City business will be prohibited if the employee is not authorized to drive a City vehicle or if the employee does not have personal insurance coverage.
For information regarding pre-screening and driving positions,
• .
• The City job description can be found here.

The minimum qualifications listed above, plus:

• Three years of experience working in a cybersecurity environment.
• Experience with/in:
  • SIEM (Security Information and Event Management) platforms such as Splunk, Sentinel, QRadar, ArcSight, etc.
  • EDR/XDR or email product tools such as CrowdStrike or Proofpoint.
  • Investigating malware, suspicious scripts, lateral movement, and identifying suspicious processes.
  • Cloud platforms (Azure, AWS, GCP) is preferred.
  • Industry recognized certifications such as Security+, CySA+, CEH, or GSEC, is desired.

Recruitment closes July 7, 2026. All materials must be received by 11:59 p.m. on this date.

This is a position-based recruitment and will not result in any ongoing eligibility list. This recruitment and any selection processes resulting from this recruitment may be used to fill other related vacancies within the organization now or in the near future.

Apply online by completing the required information and attaching, as one document, your cover letter and resume. Please include your experience as it relates to the qualifications stated above. Only the highest qualified may be posted to the eligible to hire list. The results of the resume screening process will be sent to your primary email address.

During the online application process, you will provide responses to questions regarding your experience and qualifications (the system allows copy/pasting into the answer fields). Information you provide in these questions should align to the information in your resume. Information not consistent with your resume may not be considered when determining your education and/or experience level.

• Job interviews may be held by video or audio conference.
If you are in need of computer resources,
• for free options.
Arizona at Work has frequent classes to help with resume writing, interviewing skills, and general career guidance.
• for more information.
• Explore other Employment Opportunities with the City of Phoenix.
• Subscribe to receive e-mail notifications about new employment opportunities.
• If you require assistance at any stage of the application process due to an accessibility issue, please contact the Human Resources Department by phone at (602) 495-5700 or by text at (800) 367-8939. You may also fill out and submit a Reasonable Accommodation Request Form.

Info Tech Service Specialist, JC:09840, ID# , 06/18/26, USM, VM, Benefits:007

Building the Phoenix of tomorrow.

#DoWorkThatMakesPhoenixWork

City of Phoenix is an equal opportunity employer. AmeriCorps, Peace Corps, and other national service alumni who meet the required qualifications are encouraged to apply.