Cybersecurity Firewall Analyst

Duke Energy Corporation•Charlotte, NC

2d•Hybrid

About The Position

The Cybersecurity Network Defense Analyst (CNDA) is responsible for protecting Operational Technology (OT) environments, including substation networks, against unauthorized cyber activity through the governance, validation, and continuous monitoring of network defense controls. This role ensures that security technologies, access controls, and network segmentation strategies are implemented and maintained in alignment with NERC CIP standards (e.g., CIP-005, CIP-007, CIP-010), TSA Security Directives, SOX controls, and PCI-DSS requirements. The CNDA operates within a compliance-driven, risk-based framework, with primary accountability for independent validation and oversight of firewall configurations, rule changes, and network security controls. This includes reviewing and approving firewall rule sets, verifying adherence to least privilege and segmentation requirements, and ensuring all changes are properly authorized, documented, and auditable. The role emphasizes control effectiveness validation rather than direct implementation, ensuring separation of duties and alignment with audit expectations. This position supports OT/substation defense operations by maintaining strong visibility into Electronic Security Perimeters (ESPs), External Routable Connectivity (ERC), and access pathways into critical infrastructure environments. Responsibilities include control testing, evidence generation, and audit support, as well as identifying and remediating compliance gaps through structured corrective actions. In addition, the CNDA contributes to incident response, event analysis, and service disruption investigations, performing root cause analysis with a focus on control effectiveness and preventive improvements. The role actively participates in CIP-010 baseline management and change validation processes, ensuring that all network security modifications are properly assessed, validated, and reflected in system baselines. The CNDA also supports project-based initiatives related to substation defense, firewall deployments, and network segmentation enhancements, providing oversight to ensure solutions are implemented in accordance with regulatory requirements and internal security standards. This includes maintaining accurate documentation and artifacts required to demonstrate compliance during internal and external audits. Candidates with a strong background in network engineering, OT networking, or infrastructure design who are transitioning into cybersecurity will be considered, particularly those with the ability to apply technical expertise within a highly regulated, audit-focused environment.

Requirements

Bachelors degree in Computer Science, Cybersecurity, Information Technology, or Other Related Degree
2 years related work experience
In lieu of Bachelors degree(s) AND 2 year(s) related work experience listed above, High School/GED AND 6 year(s) related work experience

Nice To Haves

CCNP and/or CISSP and/or GCIH and/or GIAC Information Security Professional and/or CompTIA Security+ and/or SANS
Experience in Cybersecurity preferably with firewall and proxy technology, event logging and detection mechanisms.
Knowledge of foundational computer elements from the operating system, TCP/IP, routing and network topology.
Knowledge of cybersecurity and privacy principles.
Knowledge of the application firewall concepts and functions (e.g., Single point of authentication/audit/policy enforcement, message scanning for malicious content, data anonymization for PCI and PII compliance, data loss protection scanning, accelerated cryptographic operations, SSL security, REST/JSON processing).
Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.
Skill in configuring and utilizing network protection components (e.g., Firewalls, VPNs, network intrusion detection systems).
Skill in performing packet-level analysis.
Ability to apply network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
Knowledge of web filtering technologies
Diagnose and resolve customer reported system incidents, problems, and events.
Direct background or exposure to cyber security operations
Experience with IDPS functionality.
Experience with Palo Alto Firewalls.
1-5 years of relevant work experience in Information Technology.
Compliance experience (PCI/SOX).
Experience with Syslog, TACACS, Radius, and SNMP.
Ability to perform self-directed work.
Experience in networking protocols: DNS, HTTP, SSL, SMTP, TCP
Experience working with Hardware Security Models
Experience in Web security and compliance experience (e.g., Firewalls, IDS/IPS systems, DDOS prevention and PCI, HIPAA, FIPS, etc.)
Strong Linux or Windows system administrator skills

Responsibilities

Perform day-to-day oversight and validation of firewall policy administration, including review, approval, and lifecycle management of network access control rules on specialized cyber defense systems
Review, validate, and govern network access control lists (ACLs) to ensure alignment with least privilege, segmentation requirements, and regulatory expectations
Participate in security improvement and optimization initiatives, providing recommendations to enhance control effectiveness, resiliency, and compliance posture
Maintain accurate and up-to-date documentation of network security infrastructure, configuration changes, and security strategies to support audit readiness and operational transparency
Develop and support testing and validation procedures for network security controls, ensuring changes are properly assessed and meet compliance requirements prior to implementation
Collaborate with security architecture and engineering teams to interpret, apply, and enforce security requirements within OT and substation environments
Provide oversight of network defense system lifecycle activities (installation, configuration, testing, and maintenance), ensuring implementations meet regulatory and internal standards
Support and provide regulatory guidance for project-based firewall and network security deployments
Proactively identify security risks, control gaps, and compliance issues, and recommend corrective actions aligned with NERC CIP, TSA, SOX, and PCI requirements
Participate in or lead MREE and TSA audit requests and interviews.