Back to jobs
New

Cybersecurity Operations Center Analyst

Rensselaer, New York, United States

The New York Independent System Operator (NYISO) manages the efficient flow of electricity on more than 11,000 circuit-miles of high-voltage transmission lines, dispatching power from hundreds of generating units across the state.

The NYISO’s Information Technology department invites applications for a full-time Cyber Security Operations Center Analyst

The NYISO Cybersecurity Operation Center’s (CSOC) mission is to provide a central point for 24x7x365 continuous security monitoring of NYISO’s computing environments and for responding to cyber threats, vulnerabilities and incidents that can disrupt and/or compromise the mission and operation of the NYISO.

Cybersecurity Operations Center Analysts will perform a wide range of technical cybersecurity services with a focus on responding to cyber threats, intrusions, and incidents; Preventing or mitigating cyber threats and intrusions from adversely impacting the NYISO; Incorporating security operations into NYISO’s business continuity and disaster recovery operations; Providing metric, context, and risk-based driven cyber and business reporting; Collaborating and cooperating with NYISO IT Operations and Administrative groups to provide monitoring and security related oversight of critical infrastructure; Keeping all stakeholders informed of evolving threats and vulnerabilities that could impact NYISO infrastructure with the goal of enabling quick mitigation and/or remediation if such threats or vulnerabilities are ever acted upon.

This position involves critical duties and responsibilities that must continue to be performed during crisis situations and contingency operations. Analysts are required to work shift rotations to support around the clock (24x7x365) coverage of the CSOC.

ESSENTIAL DUTIES AND RESPONSIBILITIES

  • As an active member of the team, provide around the clock monitoring, analysis, and response to cyber security events.
  • Stay ahead of and remain knowledgeable about new threats. Analyze all sourced cyber- intelligence of attacker tactics, techniques, and procedures (TTPs) across a large heterogeneous network of security devices and end-user systems.
  • Participate in threat modeling collaboration with other members of the IT security team.
  • Use automation to orchestrate solutions (SOAR) that automate repetitive tasks, and mature monitoring and response capabilities.
  • Assist with incident response activities, including triage, remediation and documentation.
  • Provide aid in threat and vulnerability research by assessing event data collected by systems both inside and outside of the CSOC.
  • Investigate and document events to aid incident responders, managers and other CSOC team members on security issues and the emergence of new threats.
  • Work alongside other security team members to hunt for and identify possible indication of compromise to the organization computing environments.
  • Recognize potential, successful, and unsuccessful intrusion attempts and compromises thorough reviews and analyses of relevant event information. Escalate intrusions and compromises to NYISO’s network infrastructure, applications, and operating systems to the CSIRT as needed.
  • Execute defined standard operating procedures, event and job aides required for successful task completion.
  • Analyze and mitigate or remediate software and hardware vulnerabilities.
  • Integrate and share information with other analysts and other teams.
  • Recommend changes to Standard Operating Procedures and other similar documentation.
  • Generate end-of-shift reports for documentation and knowledge transfer to subsequent analysts on shift.
  • Maintain records of security monitoring and incident response activities, utilizing case management and ticketing technologies.
  • Other duties as assigned.
  • Provide threat and vulnerability analysis reporting as well as security advisory services.

 

REQUIRED QUALIFICATIONS

  • Bachelor's Degree (BS) in Information Security, Computer Science, Computer Information Systems or similar fields required. In lieu of degree requirements, significant security and/or industry experience may be considered
  • 1-3 years of experience as a Cyber Security Analyst or a Bachelor of Science or other advanced degree or cyber security experience may be considered.
  • Knowledge of various security methodologies and processes, and technical security solutions (firewall, intrusion detection systems, and Security Information and Event Management (SIEM) platforms).
  • Knowledge of TCP/IP Protocols, network analysis, and network/security applications.
  • Knowledge of common Internet protocols and web applications.
  • Ability to multi-task, prioritize, and manage time effectively.
  • Strong attention to detail.
  • Excellent interpersonal skills and professional demeanor.
  • Excellent verbal and written communication skills.
  • Excellent customer service skills.
  • Proficient in Microsoft Office Applications.

PREFERRED QUALIFICATIONS

  • Experience administrating various operating systems (e.g., Windows, OS X, Linux, etc.) commonly deployed in enterprise networks. A conceptual understanding of Windows Active Directory is also desired.
  • Working knowledge of network communications and routing protocols (e.g., TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g., SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.)
  • Experience working with various event logging systems and be proficient with security event log analysis. Previous experience with Security Information and Event Monitoring (SIEM) platforms that perform log collection, analysis, correlation, and alerting is also desired.
  • Experience in analyzing net flow data and packet capture (PCAP).

 

CERTIFICATES, LICENSES, REGISTRATIONS

  • GCIA, GCIH, GIAC, CISSP, CISA, CEH, or similar certification preferred. DHS Secret Clearance or above preferred.

 

ADDITIONAL REQUIREMENTS

  • Ability to read, analyze and interpret general business periodicals, professional journals, technical procedures and governmental regulations. Ability to write reports, business correspondence and procedure manuals. Ability to write presentations and articles for publication that conform to prescribed style and format. Ability to effectively communicate security and risk-related concepts to technical and non-technical audiences.
  • Ability to add, subtract, multiply and divide in all units of measure, using whole numbers, common fractions and decimals. Ability to compute rate, ratio and percent and to draw and interpret bar graphs.
  • Ability to define problems, collect data, establish facts and draw valid conclusions. Ability to interpret an extensive variety of technical instructions in mathematical or diagram form and deal with several abstract and concrete variables.
  • Proficient with personal computers running the Windows operating system; experience with productivity software such as Microsoft Office applications, e-mail and Internet programs.

 

PHYSICAL DEMANDS

While performing the duties of this job, the employee is regularly required to talk or hear. The employee frequently is required to stand, walk, sit and use hands to perform routine office tasks. The employee is occasionally required to reach with hands and arms. The employee must occasionally lift and/or move up to 15 pounds. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

 

WORK ENVIRONMENT

The noise level in the work environment is usually moderate. Contact with staff and public will occur. Travel may be required to attend and/or conduct meetings, conferences and training. This position may require work on nights, weekends or holidays. Department supports a 24-hour business operation every day of the year and staff will be required to rotate on-call coverage.

 

At the NYISO, we realize the importance of balancing the availability of remote work with the inherent value of bringing people together to attain success in the areas of maximum collaboration, relationship building and growth, teamwork, innovation and problem solving, as well as professional development and mentoring. In this role, you will be required to work onsite from our Rensselaer, NY location several days per workweek, with the option to work remotely on the remaining days. You will also be expected to respond to all business needs that may require any increase to the regular onsite requirements.

The NYISO takes pride in recruiting, developing and retaining highly talented individuals. In addition to competitive salaries, we offer a comprehensive benefits package and innovative reward programs.

All offers of employment will be made contingent upon the successful completion of a drug screening and background check.

The NYISO is an Equal Opportunity Employer and as such, does not discriminate in its hiring or employment practices.

#LI-Onsite

Salary Range

$78,500 - $131,100 USD

Create a Job Alert

Interested in building your career at New York ISO? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf


Education

Select...
Select...
Select...

Select...
Select...
Select...

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in New York ISO’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.