Security Engineer

This position will be filled as an Information Security Engineer III or Sr depending on the candidates experience and qualifications.

This position may be filled in Jackson, MS; Little Rock, AR; The Woodlands, TX; or New Orleans, LA.

Brief Position Description:

The Senior Information Security Engineer is responsible for proactively improving and evolving a successful security engineering function within Information Security. The Security Engineering team owns the deployment and operation of security monitoring tools and processes designed for real-time analysis, triage, and response to events and alerts generated across the enterprise to protect the company’s assets, solutions, and services by reducing time to respond to and if necessary, remediate security incidents and risks. This role is focused on interpreting cyber security event data, security validation tests, user behavior analytics, third party threat intel, and XDR data to develop security detection and response use cases as well as tune the systems that support the development of alert, response, and forensic data creation.

Key responsibilities include:

1. Act as primary detection engineer. Lead identification and implementation of detection and response use cases in partnership with the security operations center utilizing telemetry provided by or stored in one or more of the following sources: SIEM, XDR, Security Validation, External Threat Intelligence, User Behavior Analytics, and any additionally identified sources of security event data.
2. Implement necessary monitoring policies, reference architectures, and procedures in compliance with statutory and regulatory requirements covering internal and external parties, regulated and non-regulated physical, operational, and business systems throughout the enterprise.
3. Assist in satisfying specific requirements to ensure security of the environment in compliance with North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) and Nuclear Regulatory Commission (NRC) Nuclear Cyber (10 CFR 73.54).
4. Execute on strategy & technology roadmap for the Security Information Event Management (SIEM) platform.
5. Drive process excellence and maturity to push the envelope on delivering a world-class Cyber Security function to protect Entergy against cyber threats.
6. Support life-cycle management of the SIEM platform, and other interconnected or related monitoring platforms including assistance with coordination and planning of upgrades, new deployments, and maintenance of current operational systems.
7. Execute on world-class cyber defense capability for all information technology and operational technology assets including power generation units, nuclear plants, electric substations, SCADA, distribution automation, advanced metering infrastructure (AMI), email, and networks.
8. Work closely with Consolidated Security Operations Center (CSOC), Threat & Vulnerability Management (TVM), other internal/external teams and management in a 24x7 operational environment.
9. Execute the processes to monitor, analyze, and correlate logs and alerts across multiple platforms to identify advanced threats or incidents affecting the enterprise and aiding in the development of security monitoring use cases.
10. Assist in maintaining documentation and evidence to be used for after action reporting and/or legal evidence.
11. Monitor and respond to regulatory developments and industry best practices, with manager direction.
12. Accountable for execution of security engineering support of all device classes (server, desktop, mobile, etc.), hosting models (on-premises, external, cloud) and applications to which security platforms apply.
13. Work closely with all teams in Information Security to implement use cases for monitoring or SOAR.
14. Deliver on KPIs to measure effectiveness of security engineering and report trends.
15. Support security orchestration and automation efforts and help to identify opportunities to improve security response and precision.
16. Collaborate and work across other IT and Information Security areas to design and onboard new systems to follow monitoring standards and best practices.
17. Oversee and review work of junior resources as needed.

Minimum knowledge, skills, and abilities required of the position (combination of the following):

1. Demonstrated technical engineering and process management skills and the ability to advocate and support positive transformation within the broader information technology organization.
2. Knowledge of cloud monitoring strategies and techniques.
3. Knowledge of Security orchestration, automation, and response.
4. Knowledge of User and Entity Behavior Analytics.
5. Broad knowledge of multiple UNIX OS platforms and Windows-based operating systems.
6. Well-versed in security operations, cyber security monitoring, intrusion detection, and secured networks.

Highly qualified candidates will be able to demonstrate knowledge of multiple of the following:

1. Strong knowledge of security ramifications of businesses regulations (SOX, HIPAA, NERC CIP, FERC, and NRC Nuclear Cyber (10 CFR 73.54).
2. Demonstrable experience developing and deploying security orchestration, automation, and response.
3. Demonstrable experience developing and deploying user and entity behavior analytics platform and programs.
4. Knowledge of security, risk, and control frameworks and standards such as ISO 27001 and 27002, SANS-CAG, NIST, FISMA, COBIT, COSO ITIL, and ATT&CK.
5. Knowledge of current IT Security trends and best practices in technology, as well as monitoring best practices and tools.
6. Working knowledge with scripting languages such as Perl or Python.
7. Strong understanding of cloud computing and patterns involved in monitoring across cloud, hosted and on-prem architectures.
8. Strong report writing and communication and ability to effectively communicate across the IT organization.
9. The ability to work well independently or with a team.
10. Capable of meeting deadlines.

Any certificates, licenses, etc., required for the position:

CISSP, CISM, CISA or GIAC certifications are a plus.

WORKING CONDITIONS:

As a provider of essential services, Entergy expects its employees to be available to work additional hours, to work in alternate locations, and/or to perform additional duties in connection with storms, outages, emergencies, or other situations as deemed necessary by the company. Exempt employees may not be paid overtime associated with such duties.

Please note: Authorization to work in the United States is a precondition to employment in this position. Entergy will not sponsor candidates for work visas for this position.