Follow documented investigation methodologies while exercising judgment to determine when activity can be resolved within the TSOC or requires escalation.
Document investigative actions, evidence, conclusions, mitigations, and escalations clearly enough that another analyst can reproduce and understand the investigation.
Support incident-response activities, including evidence collection, containment and mitigation, investigative documentation, and coordination with senior analysts and incident responders.
Participate in TSOC incident-response preparation, tabletop exercises, training, after-action activities, and continuous improvement efforts.
Process suspected phishing, malicious-document, malware, identity, network, endpoint, cloud, and OT security events.
Use threat intelligence and the MITRE ATT&CK framework to understand attacker behavior and improve investigations.
Assist with or perform forensic analysis and evidence collection when required.
Identify false positives, detection gaps, workflow failures, and opportunities to improve alert quality.
Support security automation, SOAR playbooks, detection content, dashboards, reporting, metrics, procedures, and knowledge documentation.
Monitor and identify issues affecting the TSOC investigation workflow or security-tool ecosystem and escalate operational problems appropriately.
Collaborate with other FirstEnergy Cyber Security, IT, OT, compliance, and business teams during investigations and security initiatives.
Maintain awareness of the current threat landscape and emerging attacker techniques.
Participate in projects and continuous-improvement efforts that mature TSOC capabilities.
As experience increases, provide case review, mentoring, training, process ownership, platform support, project leadership, and technical escalation for less-experienced analysts.
Required Qualifications
Candidates should demonstrate an appropriate combination of education, IT experience, cybersecurity experience, and practical technical capability.
Foundational understanding of cybersecurity principles and security operations.
Understanding of Windows operating systems and common security-relevant Windows events.
Familiarity with Linux operating systems.
Understanding of networking fundamentals including TCP/IP, DNS, HTTP/S, network addressing, and common network protocols.
Familiarity with SIEM, EDR/XDR, SOAR, or comparable security technologies.
Understanding of alert triage and cybersecurity investigation methodology.
Familiarity with common cybersecurity threats including phishing, credential compromise, malware, suspicious scripting, and attacker persistence techniques.
Foundational understanding of MITRE ATT&CK and attacker tactics, techniques, and procedures.
Ability to interpret or develop basic scripts and queries using technologies such as PowerShell, Python, Bash, KQL, or SPL.
Strong analytical, troubleshooting, and problem-solving skills.
Strong written and verbal communication skills.
Ability to clearly document technical investigative findings.
Ability to appropriately handle confidential and security-sensitive information.
Ability to learn independently while also knowing when to collaborate or escalate.
Ability to work effectively in an environment where operational priorities may change rapidly.
Ability to work independently with appropriate judgment and minimal supervision.
Preferred Qualifications
Previous SOC, cybersecurity operations, incident-response, system administration, networking, IT support, or related technical experience.
Experience with SIEM / TIP / SOAR / OT Monitoring, or similar security technologies.
Experience investigating phishing, malware, identity, endpoint, network, cloud, or OT security events.
Experience with KQL, SPL, PowerShell, Python, or other query/scripting languages.
Familiarity with ICS/OT cybersecurity concepts.
Familiarity with digital forensics or malware-analysis concepts.
Experience working with security metrics, dashboards, detection engineering, or automation.
Certifications such as CompTIA Security+, CySA+, Microsoft SC-200, Splunk Certified Cybersecurity Defense Analyst, or equivalent practical experience.
Schedule / Operational Requirements
TSOC provides 24x7 security monitoring, so positions assigned to console operations will include day and night coverage as well as 12-hour shifts.
Analysts must be able to respond appropriately to security events originating from multiple monitoring and communication channels.
Analysts are expected to maintain situational awareness during assigned operational coverage and follow established shift-handoff and escalation procedures.
Participation in incident-response activities or other critical cybersecurity events may occasionally be required outside normal schedules depending upon level and assigned responsibilities.
Benefits, Compensation & Workforce Diversity
At FirstEnergy, employees are key to our success. We depend on their talents to meet the challenges of our changing business environment. We are committed to rewarding individual and team efforts through our total rewards philosophy which includes competitive pay plus incentive compensation, a company-sponsored pension plan, 401(k) savings plan with matching employer contribution, a choice of medical, prescription drug, dental, vision, and life insurance programs, as well as skills development training with tuition reimbursement. Please visit our website at www.firstenergycorp.com to learn more about all of our employee rewards programs. FirstEnergy proudly supports workforce diversity. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status as a protected veteran, or status as a qualified individual with a disability. No recruiters or agencies without a previously signed contract. Unable to sponsor or transfer H-1B visas at this time.
Safety
Safety is a core value for FirstEnergy and is essential to all of our business activities. We ensure employees have the tools, information, and processes to perform their duties in a manner that assures safety for themselves, their co-workers, our customers and the public. Our goals are to provide a safe work environment, to maintain an accident-free, injury-free workplace, and to promote and maintain public safety. To meet these goals, we dedicate ourselves to achieving world-class safety standards.
Position Classification
Exempt
FirstEnergy Human Resources Team
