Cybersecurity Operations Engineer

As the nations first statewide transmission only company VELCO manages the safe reliable cost-effective transmission of electric power throughout Vermont and as a part of the integrated New England regional network.

At VELCO cybersecurity is essential to maintaining a reliable and resilient electric grid. As a Cybersecurity Operations Engineer you will play a critical role in protecting VELCOs corporate technology environment from evolving cyber threats while supporting the secure delivery of the technology and services our organization depends on.

If you enjoy solving complex problems investigating suspicious activity improving security capabilities and working with a team committed to protecting critical infrastructure this is an opportunity to make a meaningful impact.

This role combines hands-on security operations incident response threat analysis vulnerability management security engineering and regulatory compliance. You will work across endpoints identities networks servers cloud services applications and third-party connections while partnering with Information Security IT Infrastructure business teams Compliance Legal Human Resources and other stakeholders.

You will also contribute to VELCOs NERC CIP cybersecurity program including cybersecurity incident response activities under CIP-008 internal network security monitoring under CIP-015 and risk assessment support under CIP-013.

The Cybersecurity Operations Engineer is expected to independently complete assigned operational and compliance-support activities apply sound judgment during security events and escalate material risks promptly. The role performs complex security analysis develops repeatable operational procedures maintains defensible records and contributes to continuous improvement of VELCOs corporate cybersecurity program. The position typically requires progressively responsible experience sufficient to operate with limited oversight while collaborating effectively across technical and business functions.

Responsibilities

• Monitor and triage security alerts from corporate endpoints identity platforms networks servers cloud services email applications and other enterprise security technologies.
• Investigate suspicious activity validate the scope and severity of events document findings coordinate containment and remediation and escalate incidents in accordance with VELCO procedures.
• Participate in VELCOs cybersecurity incident response program and NERC CIP-008 activities including preparation testing event classification support evidence preservation response coordination recovery lessons learned and maintenance of incident records.
• Participate in NERC CIP-015 internal network security monitoring activities including support for monitoring strategy sensor and data-source coverage alert review analysis escalation evidence retention testing and documented process improvement.
• Administer and improve corporate security operations tools such as security information and event management endpoint detection and response email security vulnerability management identity protection network monitoring and security orchestration technologies.
• Develop and tune detections dashboards correlation rules use cases playbooks and response procedures to improve visibility and reduce response time while managing false positives.
• Conduct vulnerability assessment and remediation coordination for corporate systems; validate risk establish priorities with system owners track corrective actions and report unresolved exposure.
• Support identity and access security through review of privileged activity authentication anomalies account misuse access-control exceptions and other indicators of compromise.
• Analyze threat intelligence and emerging attack techniques for relevance to VELCO recommend practical defensive actions and incorporate useful indicators and behaviors into monitoring processes.
• Perform proactive threat hunting and security analysis using available telemetry baselines and contextual information to identify malicious or abnormal activity.
• Maintain accurate case notes operational metrics evidence procedures diagrams inventories and other records needed for management reporting audits investigations and regulatory compliance.
• Partner with IT Infrastructure and application owners to securely implement changes validate logging and monitoring requirements and resolve security issues affecting corporate services.
• Support security assessments control testing audit requests regulatory reviews tabletop exercises and corrective action plans in coordination with VELCOs Compliance and business teams.
• Provide security guidance and awareness to employees and technical teams translating technical findings into clear business risk recommended actions and status updates.
• Participate in project planning technology evaluations vendor security reviews and implementation activities to ensure security requirements are addressed throughout the solution lifecycle.
• Participate in an on-call rotation and support coordinated response during significant cybersecurity events or operational emergencies.
• Represent VELCO in appropriate industry regional and regulatory forums; maintain current knowledge through training exercises workshops and professional development.
• Perform other duties as assigned.

Education & Training

Bachelors degree in cybersecurity information technology computer science information systems or a related technical discipline is preferred. An associate degree recognized technical or military training or an equivalent combination of relevant education and progressively responsible experience may be considered. At least one current industry-recognized cybersecurity certification aligned with security operationssuch as CompTIA Security CompTIA CySA GIAC Certified Incident Handler (GCIH) GIAC Certified Intrusion Analyst (GCIA) or an equivalent credentialis preferred; candidates without a certification may be expected to obtain an approved credential within 12 months of hire. The position requires ongoing role-based training in incident response security monitoring and detection threat analysis vulnerability management cloud and identity security and applicable VELCO procedures and NERC CIP requirements including CIP-008 and CIP-015.

Experience

37 years of progressively responsible experience in cybersecurity operations security engineering incident response infrastructure security or a related field. Experience in a regulated environment electric utility or critical infrastructure organization is preferred. Practical experience investigating alerts administering security tools coordinating remediation and producing clear operational or compliance evidence is expected.

Knowledge/Skills

• Working knowledge of security operations center practices incident handling threat analysis alert triage case management and escalation.
• Experience with SIEM endpoint detection and response vulnerability management email security identity protection network security monitoring and related enterprise security platforms.
• Knowledge of Windows and Linux systems Microsoft Active Directory and Entra ID Microsoft 365 virtualization networking DNS DHCP VPN technologies cloud services and common enterprise applications.
• Ability to analyze logs and telemetry from endpoints identity systems firewalls network devices servers cloud platforms and applications to identify suspicious behavior and determine impact.
• Understanding of cybersecurity incident response lifecycles evidence handling root-cause analysis recovery lessons learned and the preparation of clear incident documentation.
• Familiarity with internal network security monitoring concepts detection engineering traffic and flow analysis sensor coverage logging architecture and escalation procedures.
• Working knowledge of NERC CIP concepts and the ability to support documented controls evidence testing and audit activities particularly for CIP-008 and CIP-015.
• Familiarity with recognized cybersecurity practices and frameworks such as NIST guidance CIS Controls MITRE ATT&CK vendor security guidance and risk-based vulnerability management.
• Ability to develop and maintain scripts queries automation playbooks test plans and technical procedures that improve security operations while following change-control requirements.
• Strong analytical troubleshooting organizational and project coordination skills with careful attention to detail and the ability to manage competing priorities.
• Excellent written and verbal communication skills including the ability to explain technical findings operational impact compliance considerations and recommended actions to technical teams management auditors and business stakeholders.
• Ability to maintain confidentiality exercise sound judgment work effectively during high-pressure events and collaborate professionally across a diverse organization.

• Open office setting and dog friendly
• Opportunity to work closely with engineering IT and operations
• Mission-driven organization supporting critical energy infrastructure
• Collaborative cross-functional team environment

Physical/Mental Demands

Prolonged periods of sitting at a desk and working on a computer are required. The position must be able to perform detailed analytical work manage multiple priorities communicate clearly during time-sensitive events and maintain accuracy in potentially stressful situations with frequent interruptions. Participation in rotating on-call coverage and work outside normal business hours may be required for significant security events maintenance exercises or regulatory activities. Periodic travel and overnight stays may be required for training workshops meetings or industry events.

Compensation Range:

This compensation range represents the minimum midpoint and maximum pay for this position. Individual offers will be based on various factors including but not limited to qualifications education skills competencies and experience. Please note that most offers for new employees fall under the midpoint of the range allowing room for continued salary growth. Base pay is just one component of our total compensation package which may also include comprehensive benefits generous paid time off and incentive compensation (bonus) potential.