Lead Cyber Detect & Response Specialist

Iberdrola•Vestal, NY

4d•$116,640 - $145,800•Onsite

About The Position

The Lead Cybersecurity Specialist, Cyber Detection & Response is responsible for detecting and responding to security incidents and threats within Avangrid’s Operation Smart Grid (OSG) and other business units, including Control Systems and Automation, OSG Telecommunications, OSG Infrastructure, OSG AMI, Distributed Automation, Process & Technology, Innovation, Corporate Security, Corporate Risk, Legal, Insurance, Audit, Investment Planning, and Regulatory. The role engages throughout the incident lifecycle, provides leadership and mentorship to indirect reports, assesses threats, and oversees mitigations. The specialist leads security services and solutions supporting Avangrid’s evolution toward a zero-trust security framework and helps establish a defined, highly available, repeatable OSG incident detection and response program measured through key performance, risk, and operational metrics. The role investigates and mitigates threats, coordinates incident response across IT and OT business units, and provides timely information and remediation guidance to leadership and stakeholders. The position is based onsite five days per week in Rochester or Binghamton, New York. Employees may be assigned a system emergency role and may be required to work outside their regular schedule or duties during a system emergency. The role may also be assigned NERC Reliability Standards compliance responsibilities involving additional access protections, training, audits, and evidence retention.

Requirements

A master’s degree in Engineering, Computer Science, or a related technical field and at least 6 years of cybersecurity experience; or a bachelor’s degree in one of these fields and at least 8 years of cybersecurity experience; or an associate degree in one of these fields and at least 10 years of cybersecurity experience.
At least 3 years of Information Security experience.
Hands-on troubleshooting, analysis, and technical expertise to resolve incidents and service requests, including experience with operational processes such as security monitoring, data correlation, and security operations.
Proven experience analyzing security events and incidents to determine root cause and provide resolution.
Strong working knowledge of at least three security tools or areas, such as host-based antivirus, anti-spam gateway solutions, firewalls, IDS/IPS, server and network device hardening, data loss prevention, forensics software, vulnerability management, or website security.
Competence using internal and external ticketing systems for incident, problem, and change management.
Excellent oral and written communication skills.
Experience working with Cyber Threat Intelligence, Threat Defense, and Hunting teams.
Ability to lead in a customer-oriented way and communicate with technical and business-unit stakeholders.
Experience with access-control systems and solutions, such as SSO, AD, TACACS, MFA, or cloud-based systems.
Experience with information and network security infrastructure and tools, such as SIEM, IDS/IPS, firewalls, WAF, and configuration management.
Experience with security processes and procedures, including system hardening, patch management, vulnerability management, log management, access controls, supplier management, and information classification and handling.
Experience with security operations services such as access management, electronic perimeter management, baseline management, and vulnerability assessments.
Team-focused approach and ability to work effectively with diverse stakeholders.
Proactive attitude toward identifying improvements that positively affect security posture and the business.
Ability to work effectively under pressure while maintaining a professional approach.
Sound decision-making ability, including weighing the relative costs and benefits of possible actions.

Nice To Haves

Relevant technical security certifications, such as CISM, CEH, Security+, CISSP, or GSOC.
Security architecture or management certifications, such as ISO27000 or ISACA.
Knowledge of Federal Government cybersecurity activities and practices.
Experience in Federal or State regulatory environments.
Experience in Federal cybersecurity agencies and environments.
Experience in a utility environment.
Experience working with international teams.
Security clearance.
Threat Intelligence or forensic background.

Responsibilities

Lead the development and deployment of security services and solutions in support of Avangrid’s evolution toward a zero-trust security framework.
Assist in establishing a well-defined, highly available, repeatable OSG security incident detection and response program, measured using key performance, risk, and operational metrics.
Identify, respond to, and mitigate threats to Avangrid and its affiliated entities.
Conduct incident response, including advanced forensic investigations, malware analysis, and root cause analysis, and develop remediation guidance.
Perform immediate and short-term actions to resolve incidents rapidly, minimizing risk exposure and production downtime.
Maintain professional communications with clients and management throughout incident, problem, and change management cycles.
Coordinate and drive response and post-mortem efforts among multiple IT and OT business units.
Proactively monitor internal and external-facing environments using specialized security applications.
Provide timely, comprehensive, and accurate written and verbal information to OSG leadership.
Research and monitor security information sources to help identify threats to Avangrid networks, systems, and control systems.
Mentor and develop staff in incident response, analysis, and tools.
Develop and update incident response playbooks to align response activities with best practices, close gaps, and provide comprehensive threat mitigation.
Participate in and develop security incident and penetration-testing procedures, including testing criteria, test execution, and implementation of lessons learned.