Cybersecurity Operations Center Analyst

The New York Independent System Operator (NYISO) manages the efficient flow of electricity on more than 11,000 circuit-miles of high-voltage transmission lines, dispatching power from hundreds of generating units across the state.

The NYISO’s Information Technology department invites applications for a full-time Cyber Security Operations Center Analyst

The NYISO Cybersecurity Operation Center’s (CSOC) mission is to provide a central point for 24x7x365 continuous security monitoring of NYISO’s computing environments and for responding to cyber threats, vulnerabilities and incidents that can disrupt and/or compromise the mission and operation of the NYISO.

Cybersecurity Operations Center Analysts will perform a wide range of technical cybersecurity services with a focus on responding to cyber threats, intrusions, and incidents; Preventing or mitigating cyber threats and intrusions from adversely impacting the NYISO; Incorporating security operations into NYISO’s business continuity and disaster recovery operations; Providing metric, context, and risk-based driven cyber and business reporting; Collaborating and cooperating with NYISO IT Operations and Administrative groups to provide monitoring and security related oversight of critical infrastructure; Keeping all stakeholders informed of evolving threats and vulnerabilities that could impact NYISO infrastructure with the goal of enabling quick mitigation and/or remediation if such threats or vulnerabilities are ever acted upon.

This position involves critical duties and responsibilities that must continue to be performed during crisis situations and contingency operations. Analysts are required to work shift rotations to support around the clock (24x7x365) coverage of the CSOC.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• As an active member of the team, provide around the clock monitoring, analysis, and response to cyber security events.
• Stay ahead of and remain knowledgeable about new threats. Analyze all sourced cyber- intelligence of attacker tactics, techniques, and procedures (TTPs) across a large heterogeneous network of security devices and end-user systems.
• Participate in threat modeling collaboration with other members of the IT security team.
• Use automation to orchestrate solutions (SOAR) that automate repetitive tasks, and mature monitoring and response capabilities.
• Assist with incident response activities, including triage, remediation and documentation.
• Provide aid in threat and vulnerability research by assessing event data collected by systems both inside and outside of the CSOC.
• Investigate and document events to aid incident responders, managers and other CSOC team members on security issues and the emergence of new threats.
• Work alongside other security team members to hunt for and identify possible indication of compromise to the organization computing environments.
• Recognize potential, successful, and unsuccessful intrusion attempts and compromises thorough reviews and analyses of relevant event information. Escalate intrusions and compromises to NYISO’s network infrastructure, applications, and operating systems to the CSIRT as needed.
• Execute defined standard operating procedures, event and job aides required for successful task completion.
• Analyze and mitigate or remediate software and hardware vulnerabilities.
• Integrate and share information with other analysts and other teams.
• Recommend changes to Standard Operating Procedures and other similar documentation.
• Generate end-of-shift reports for documentation and knowledge transfer to subsequent analysts on shift.
• Maintain records of security monitoring and incident response activities, utilizing case management and ticketing technologies.
• Other duties as assigned.
• Provide threat and vulnerability analysis reporting as well as security advisory services.

 

REQUIRED QUALIFICATIONS

• Bachelor's Degree (BS) in Information Security, Computer Science, Computer Information Systems or similar fields required. In lieu of degree requirements, significant security and/or industry experience may be considered
• 1-3 years of experience as a Cyber Security Analyst or a Bachelor of Science or other advanced degree or cyber security experience may be considered.
• Knowledge of various security methodologies and processes, and technical security solutions (firewall, intrusion detection systems, and Security Information and Event Management (SIEM) platforms).
• Knowledge of TCP/IP Protocols, network analysis, and network/security applications.
• Knowledge of common Internet protocols and web applications.
• Ability to multi-task, prioritize, and manage time effectively.
• Strong attention to detail.
• Excellent interpersonal skills and professional demeanor.
• Excellent verbal and written communication skills.
• Excellent customer service skills.
• Proficient in Microsoft Office Applications.

PREFERRED QUALIFICATIONS

• Experience administrating various operating systems (e.g., Windows, OS X, Linux, etc.) commonly deployed in enterprise networks. A conceptual understanding of Windows Active Directory is also desired.
• Working knowledge of network communications and routing protocols (e.g., TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g., SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.)
• Experience working with various event logging systems and be proficient with security event log analysis. Previous experience with Security Information and Event Monitoring (SIEM) platforms that perform log collection, analysis, correlation, and alerting is also desired.
• Experience in analyzing net flow data and packet capture (PCAP).

 

CERTIFICATES, LICENSES, REGISTRATIONS

• GCIA, GCIH, GIAC, CISSP, CISA, CEH, or similar certification preferred. DHS Secret Clearance or above preferred.

 

ADDITIONAL REQUIREMENTS

• Ability to read, analyze and interpret general business periodicals, professional journals, technical procedures and governmental regulations. Ability to write reports, business correspondence and procedure manuals. Ability to write presentations and articles for publication that conform to prescribed style and format. Ability to effectively communicate security and risk-related concepts to technical and non-technical audiences.
• Ability to add, subtract, multiply and divide in all units of measure, using whole numbers, common fractions and decimals. Ability to compute rate, ratio and percent and to draw and interpret bar graphs.
• Ability to define problems, collect data, establish facts and draw valid conclusions. Ability to interpret an extensive variety of technical instructions in mathematical or diagram form and deal with several abstract and concrete variables.
• Proficient with personal computers running the Windows operating system; experience with productivity software such as Microsoft Office applications, e-mail and Internet programs.

 

PHYSICAL DEMANDS

While performing the duties of this job, the employee is regularly required to talk or hear. The employee frequently is required to stand, walk, sit and use hands to perform routine office tasks. The employee is occasionally required to reach with hands and arms. The employee must occasionally lift and/or move up to 15 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

 

WORK ENVIRONMENT

The noise level in the work environment is usually moderate. Contact with staff and public will occur. Travel may be required to attend and/or conduct meetings, conferences and training. This position may require work on nights, weekends or holidays. Department supports a 24-hour business operation every day of the year and staff will be required to rotate on-call coverage.

 

At the NYISO, we realize the importance of balancing the availability of remote work with the inherent value of bringing people together to attain success in the areas of maximum collaboration, relationship building and growth, teamwork, innovation and problem solving, as well as professional development and mentoring. In this role, you will be required to work onsite from our Rensselaer, NY location several days per workweek, with the option to work remotely on the remaining days. You will also be expected to respond to all business needs that may require any increase to the regular onsite requirements.

The NYISO takes pride in recruiting, developing and retaining highly talented individuals. In addition to competitive salaries, we offer a comprehensive benefits package and innovative reward programs.

All offers of employment will be made contingent upon the successful completion of a drug screening and background check.