Lead Cyber Detect & Response Specialist

Iberdrola•Rochester, NY

2d•Onsite

About The Position

The Lead Cybersecurity Specialist, Cyber Detection & Response is responsible for detecting and responding to security incidents and threats within Avangrid’s Operation Smart Grid (OSG) and other business units. The role participates across all phases of the incident lifecycle, provides leadership and mentorship to indirect reports, understands threats, and oversees mitigations. The position supports Avangrid’s evolution toward a zero-trust security framework and helps establish a well-defined, highly available, repeatable OSG incident detection and response program measured through key performance, risk, and operational metrics. The specialist investigates and mitigates threats, conducts advanced incident response activities—including forensics, malware analysis, and root-cause analysis—and develops remediation guidance. The role coordinates response efforts across IT and OT business units, proactively monitors internal and external-facing environments, communicates incident information to OSG leadership, and develops and updates incident-response playbooks. It also supports security incident and penetration-testing procedures, including testing criteria, execution, and implementation of lessons learned. The position is based on site five days per week in Rochester or Binghamton, New York. Employees may be assigned system-emergency duties that require work outside their regular schedule or job duties. Certain employees may also be assigned NERC Reliability Standards compliance responsibilities, with associated access protections, training, audit engagement, and evidence-retention requirements.

Requirements

Master’s degree in Engineering, Computer Science, or a related technical field and at least 6 years of cybersecurity experience; or a bachelor’s degree in one of these fields and at least 8 years; or an associate degree in one of these fields and at least 10 years.
At least 3 years of Information Security experience.
Hands-on troubleshooting, analysis, and technical expertise to resolve incidents and service requests, including experience with operational processes such as security monitoring, data correlation, and security operations.
Demonstrated experience analyzing security events and incidents to determine root cause and provide resolution.
Strong working knowledge of at least three of the following: host-based antivirus, anti-spam gateway solutions, firewalls, IDS/IPS, server and network-device hardening, data loss prevention, forensics software, vulnerability management, and website security.
Competence using internal and external ticketing systems for incident, problem, and change management.
Excellent oral and written communication skills.
Experience working with Cyber Threat Intelligence, Threat Defense, and Hunting teams.
Customer-oriented leadership and ability to communicate with technical and business-unit stakeholders.
Experience with access-control systems and solutions, such as SSO, AD, TACACS, MFA, and cloud-based systems.
Experience with information and network security infrastructure and tools, such as SIEM, IDS/IPS, firewalls, WAF, and configuration management.
Experience with security processes and procedures, including system hardening, patch management, vulnerability management, log management, access controls, supplier management, and information classification and handling.
Experience with security operations services, such as access management, electronic perimeter management, baseline management, and vulnerability assessments.
Team-focused mentality and ability to work effectively with diverse stakeholders.
Proactive attitude and ability to identify improvement opportunities that positively affect security posture and the business.
Ability to work under pressure while maintaining a professional image and approach.
Decision-making capability, including weighing relative costs and benefits and identifying appropriate actions.

Nice To Haves

Relevant technical security certifications, such as CISM, CEH, Security+, CISSP, or GSOC.
Security architecture or management certifications, such as ISO27000 or ISACA certifications.
Knowledge of Federal Government cybersecurity activities and practices.
Experience in Federal or State regulatory environments.
Experience in Federal cybersecurity agencies and environments.
Experience in a utility environment.
Experience working with international teams.
Security clearance.
Threat Intelligence or forensic background.

Responsibilities

Lead development and deployment of security services and solutions supporting Avangrid’s evolution toward a zero-trust security framework.
Assist in establishing a well-defined, highly available, repeatable OSG security incident detection and response program, measured using key performance, risk, and operational metrics.
Identify, respond to, and mitigate threats to Avangrid and affiliated entities.
Conduct incident response, including advanced forensic investigation, malware analysis, and root-cause analysis, and develop remediation guidance.
Perform activities needed for rapid incident resolution to minimize risk exposure and production downtime.
Maintain professional communication with clients and management throughout incident, problem, and change-management cycles.
Coordinate and drive response and post-mortem efforts among multiple IT and OT business units.
Proactively monitor internal and external-facing environments using specialized security applications.
Provide timely, comprehensive, and accurate written and verbal information to OSG leadership.
Research and monitor security information sources to identify threats to Avangrid networks, systems, and control systems.
Mentor and develop staff in incident response, analysis, and tools.
Develop and update incident-response playbooks to align response activities with best practices, close gaps, and comprehensively mitigate threats.
Participate in and develop security incident and penetration-testing procedures, including criteria, testing, and implementation of lessons learned.