Cybersecurity Operations Engineer

This job was posted by https://www.vermontjoblink.com : For more information, please see: https://www.vermontjoblink.com/jobs/1426141 # Why you should join our team \ At VELCO, cybersecurity is essential to maintaining a reliable and resilient electric grid. As a Cybersecurity Operations Engineer, you will play a critical role in protecting VELCOs corporate technology environment from evolving cyber threats while supporting the secure delivery of the technology and services our organization depends on. \ If you enjoy solving complex problems, investigating suspicious activity, improving security capabilities, and working with a team committed to protecting critical infrastructure, this is an opportunity to make a meaningful impact. # # How you will make an impact \ This role combines hands-on security operations, incident response, threat analysis, vulnerability management, security engineering, and regulatory compliance. You will work across endpoints, identities, networks, servers, cloud services, applications, and third-party connections while partnering with Information Security, IT Infrastructure, business teams, Compliance, Legal, Human Resources, and other stakeholders. You will also contribute to VELCOs NERC CIP cybersecurity program, including cybersecurity incident response activities under CIP-008, internal network security monitoring under CIP-015, and risk assessment support under CIP-013. \ The Cybersecurity Operations Engineer is expected to independently complete assigned operational and compliance-support activities, apply sound judgment during security events, and escalate material risks promptly. The role performs complex security analysis, develops repeatable operational procedures, maintains defensible records, and contributes to continuous improvement of VELCOs corporate cybersecurity program. The position typically requires progressively responsible experience sufficient to operate with limited oversight while collaborating effectively across technical and business functions. Responsibilities Monitor and triage security alerts from corporate endpoints, identity platforms, networks, servers, cloud services, email, applications, and other enterprise security technologies. Investigate suspicious activity, validate the scope and severity of events, document findings, coordinate containment and remediation, and escalate incidents in accordance with VELCO procedures. Participate in VELCOs cybersecurity incident response program and NERC CIP-008 activities, including preparation, testing, event classification support, evidence preservation, response coordination, recovery, lessons learned, and maintenance of incident records. Participate in NERC CIP-015 internal network security monitoring activities, including support for monitoring strategy, sensor and data-source coverage, alert review, analysis, escalation, evidence retention, testing, and documented process improvement. Administer and improve corporate security operations tools such as security information and event management, endpoint detection and response, email security, vulnerability management, identity protection, network monitoring, and security orchestration technologies. Develop and tune detections, dashboards, correlation rules, use cases, playbooks, and response procedures to improve visibility and reduce response time while managing false positives. Conduct vulnerability assessment and remediation coordination for corporate systems; validate risk, establish priorities with system owners, track corrective actions, and report unresolved exposure. Support identity and access security through review of privileged activity, authentication anomalies, account misuse, access-control exceptions, and other indicators of compromise. Analyze threat intelligence and emerging attack techniques for relevance to VELCO, recommend practi al defensive actions, and incorporate useful indicators and behaviors into monitoring processes. Perform proactive threat hunting and security analysis using available telemetry, baselines, and contextual information to identify malicious or abnormal activity. Maintain accurate case notes, operational metrics, evidence, procedures, diagrams, inventories, and other records needed for management reporting, audits, investigations, and regulatory compliance. Partner with IT Infrastructure and application owners to securely implement changes, validate logging and monitoring requirements, and resolve security issues affecting corporate services. Support security assessments, control testing, audit requests, regulatory reviews, tabletop exercises, and corrective action plans in coordination with VELCOs Compliance and business teams. Provide security guidance and awareness to employees and technical teams, translating technical findings into clear business risk, recommended actions, and status updates. Participate in project planning, technology evaluations, vendor security reviews, and implementation activities to ensure security requirements are addressed throughout the solution lifecycle. Participate in an on-call rotation and support coordinated response during significant cybersecurity events or operational emergencies. Represent VELCO in appropriate indu