Under the administrative direction of the Information Technology Manager II (IT Mgr II), the Information Technology Specialist III (IT Spec III) serves as the Office of Information Security's (OIS) Lead Data Architect for the Security Operations Center (SOC). The IT Spec III is responsible for the architecture, design, development, integration, and management of the large-scale security data platform that supports the agency's threat detection, incident response, and cyber defense mission. The IT Spec III leads data architecture and data modeling efforts to establish efficient, secure, and scalable methods for collecting, storing, correlating, and reporting high-volume security telemetry across a multi-tenant environment, and designs the data lake/lake house foundation that enables advanced analytics, machine learning, and AI-enabled and agentic automation for security operations. This is accomplished through the delivery of services across IT domains including Software Engineering, System Engineering, Information Security Engineering, and IT Project Management, and through the IT Spec III's leadership of the on-premises AI compute platform used to fine-tune, evaluate, and serve the machine learning and large language models supporting Tier 1 security operations.
The IT Spec III works independently or collaboratively, and acts in a lead capacity to plan and coordinate technology solutions addressing the agency's most complex security problems, including the expansion of SOC services to additional state, local, and critical-infrastructure partners, and the engineering of AI-assisted detection, triage, and threat-hunting capabilities. Additionally, the IT Spec III solicits and considers internal and external customer input when completing work assignments in the Security Solutions Operations Unit, and maintains ongoing contact with technical, administrative, and managerial staff across CDT and customer organizations. The technologies supporting these functions include Microsoft Azure (Microsoft Sentinel, Log Analytics, Azure Data Lake Storage); Databricks, Delta Lake, and Apache Spark; Kusto Query Language (KQL); Microsoft Defender XDR; MS SQL Server and T-SQL; Python (including PySpark); data pipeline/ELT tooling; REST and GraphQL web services and APIs; JSON and XML; Power BI, Power Apps, and Power Automate; containerization (Docker) and version control (GitHub); large language model (LLM) and agentic AI frameworks; and Red Hat Linux and Windows Server.
Telework
This position is eligible for a hybrid work schedule within California based on departmental policy and operational needs. The telework policy is subject to change depending on business needs, and/or reporting to the work site may be required with minimal notification given. Pursuant to Executive Order, effective July 1, 2025, employees in this position will be required to report to the work site a minimum of two (2) days per week, increasing to four (4) days per week effective July 1, 2026. The specific on-site days will be determined by the department based on operational requirements.
Visa Sponsorship
Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.
You will find additional information about the job in the Duty Statement.