{bc}
Apply
oracle

EMS Security Analyst

Southern Company
Birmingham, USA
Full-time
Mid
Onsite
Discovered 1 weeks ago
PythonCommunication

Full Job Posting

Education and Experience

  • Degree in computer science, cybersecurity, information systems, electrical engineering, or equivalent experience.
  • Industry certification preferred (CISSP, CISA, CISM, GICSP, or equivalent experience).
  • Minimum of five (5) years of cybersecurity experience. Hands-on experience in OT cybersecurity, network security monitoring, traffic analysis, or related security functions is preferred.
  • Major Responsibilities
  • Administer and support network security monitoring platforms, sensors, management systems, and supporting infrastructure across EMS/SCADA and OT environments.
  • Design, configure, and maintain network visibility architecture, including traffic aggregation, packet brokering, network taps, span monitoring, sensor placement, and secure data flows.
  • Monitor and analyze network communications to identify assets, protocols, dependencies, anomalous activity, unauthorized changes, misconfigurations, and potential cyber threats.
  • Develop and tune detections, alerts, baselines, policies, and asset classifications to improve monitoring accuracy, reduce false positives, and prioritize operationally significant risk.
  • Support packet capture, metadata collection, log forwarding, and integrations with enterprise security monitoring, incident response, vulnerability management, and reporting capabilities.
  • Partner with EMS, network, infrastructure, application, and cybersecurity subject matter experts to validate network behavior, strengthen segmentation, reduce unnecessary communications, and improve the security posture of critical systems.
  • Investigate, troubleshoot, and resolve security monitoring and network visibility issues while minimizing operational impact to EMS and SCADA environments.
  • Perform threat hunting, event triage, and incident investigation using network telemetry, packet-level evidence, asset context, and other available security data.
  • Evaluate emerging OT security and network visibility technologies and provide recommendations that support EMS cybersecurity strategy, architecture, operational, and compliance objectives.
  • Support compliance initiatives and audits related to NERC CIP, FERC, SERC, Sarbanes-Oxley, and other applicable regulatory requirements by maintaining monitoring evidence, documentation, procedures, and technical controls.
  • Develop and maintain automation, reporting, health monitoring, and operational efficiencies through scripting and tools utilizing Python, PowerShell, Perl, or shell scripting.
  • Knowledge, Skills, and Abilities
  • Experience with OT security monitoring, network visibility, packet capture, traffic analysis, or similar platforms such as Dragos, Nozomi, Claroty, Riverbed, or comparable tools.
  • Understanding of cybersecurity principles, EMS/SCADA operations, network architecture, common network protocols, and business objectives required to support secure and reliable operations.
  • Strong analytical, critical-thinking, problem-solving, and troubleshooting skills, with the ability to distinguish expected operational behavior from potentially malicious or unauthorized activity.
  • Ability to manage multiple priorities and adapt to changing operational requirements while protecting the availability and reliability of critical systems.
  • Strong organizational skills with the ability to quickly learn, evaluate, document, and apply new technologies and monitoring methods.
  • Excellent verbal and written communication skills with the ability to communicate technical findings, operational risk, and recommended actions to technical and non-technical audiences.
  • Behavioral Attributes
  • Demonstrate behaviors consistent with Southern Company's Values and commitment to customer service.
  • Be proactive, self-motivated, and accountable, with a strong sense of ownership and follow-through.
  • Build and maintain effective working relationships with team members, customers, and stakeholders across the organization.
  • Exhibit initiative, adaptability, and a collaborative approach to achieving team and organizational objectives.
  • This position falls under the company’s Insider Threat Program and will have access to, and control over sensitive data, systems or assets. Enhanced personnel screening, which includes a background review, drug screen, and psychological assessment, will be required if you are selected for this position.

Preferred Qualifications

  • Industry certification preferred (CISSP, CISA, CISM, GICSP, or equivalent experience).
  • Minimum of five (5) years of cybersecurity experience. Hands-on experience in OT cybersecurity, network security monitoring, traffic analysis, or related security functions is preferred.

Apply for this job in 1 click

Skip the repetitive application forms

Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.

Sarah M.James T.Maya R.

Trusted by over 500,000 job seekers on Base Career

Start Free Today

More from this employer

More jobs at Southern Company

Protection & Control Test Engineer/Technician

Birmingham, USA

Discovered 3 days agoFull-time

Environmental Engineer/Specialist (Environmental Compliance – Water)

Birmingham, USA

Discovered 5 days agoFull-time

Manager, Risk Management and Insurance

Atlanta, USA

Discovered 5 days agoFull-time

Instrument & Controls Technician

Rincon, USA

Discovered 5 days agoFull-time

Maintenance & Technical Training Manager- Plant Hatch

Baxley, USA

Discovered 1 weeks agoFull-time

M365 Collaboration Engineer - System Administration

Atlanta, USA

Discovered 1 weeks agoFull-time

Civil Site Designer – Design Civil Transmission (Birmingham, AL)

Birmingham, USA

Discovered 1 weeks agoFull-time

Government Contracts Coordinator (Open to hire anywhere within the SOCO Footprint)

Birmingham, USA

Discovered 1 weeks agoFull-time