Cyber Defense Specialist

LUMA Energy; San Juan (PR); On-site; USD 90,000 - 120,000; Full time

Job summary

LUMA Energy seeks an experienced cybersecurity professional to join its SOC team in Puerto Rico. You will triage alerts, investigate threats, and drive proactive defense improvements across IT/OT environments.

You will collaborate with cross-functional teams, develop and refine playbooks, and participate in on-call rotations to ensure 24/7 readiness while maintaining compliance with industry standards.

Qualifications

• Triage security alerts to determine root cause
• Investigates suspicious activity across SIEM, email, and network telemetry
• Collaborates with cross-functional cybersecurity teams for incident response
• Proactive threat hunting and intelligence analysis
• Supports vulnerability assessment and defense reviews
• Maintains playbooks and SOPs for consistent defense
• Participates in on-call coverage and 24/7 readiness
• Adheres to laws and industry regulations

Responsibilities

• Triage security alerts to determine root cause and prioritize incident handling
• Investigate suspicious activity across SIEM, email, and network telemetry
• Coordinate incident response actions with cross-functional teams to achieve resolution
• Conduct threat hunting and intelligence analysis for emerging risks
• Support vulnerability assessments and defense-architecture reviews
• Maintain and enhance defensive playbooks, rules, and SOPs
• Participate in on-call coverage for continuous SOC readiness
• Ensure compliance with applicable laws and regulations
• Contribute to storm restoration tasks and drills as needed
• Perform additional role-aligned tasks as required

Skills

SOC operations

Incident response

Threat hunting

SIEM monitoring

EDR tooling

TCP/IP basics

Windows & Linux OS

Python/PowerShell

NIST ATT&CK

Communication (EN/ES)

Education

Bachelor's degree in Cybersecurity / CS / IT / Information Assurance

Associate's degree with 8+ years relevant experience

High School + 10+ years relevant experience

Tools

Sumo Logic

CrowdStrike

Security monitoring tools

Job description

At LUMA, we are proud to have people who embody the commitment to serve. We practice a “people first” culture and recognize the significant contributions our team makes to the company’s performance. LUMA is it's people—people who work hard and give their best effort so we can achieve our service goals for Puerto Rico.

Our mission is to provide you with reliable electric power and to transform the system that lights up every home, every business, every corner of Puerto Rico. At LUMA, people come first, and safety is the foundation of everything we do.

Job Summary

Supports the protection of critical IT and OT environments by triaging alerts, investigating threats, and enhancing defensive capabilities that uphold confidentiality, integrity, and availability standards. Ensures continuous operational readiness through coordinated incident response and proactive threat hunting, driving measurable improvements in the organization’s overall security posture.

Job Description

• Triage security alerts to determine root cause and prioritize incident handling, ensuring timely and accurate escalation aligned with SOC response standards.
• Investigates suspicious activity across SIEM, email, and network telemetry to validate threats and produce evidence-based findings that support rapid containment.
• Collaborates with cross-functional cybersecurity teams to coordinate incident response actions and achieve complete resolution and documented lessons learned in accordance with established protocols.
• Conducts proactive threat hunting and intelligence analysis to identify emerging risks and deliver actionable reports that strengthen LUMA’s preventive security posture.
• Supports vulnerability assessment and defense architecture reviews to recommend improvements that ensure alignment with critical infrastructure protection standards.
• Maintains and enhances operational playbooks, detection rules, and SOPs to ensure consistent, compliant, and up-to-date defensive capabilities across the organization.
• Participates in on-call and rotating coverage to ensure continuous SOC operational readiness and consistent 24/7 incident response support.
• Follows established company policies, procedures, and standards to ensure full compliance with applicable laws and industry regulations.
• Participates in storm restoration tasks and assigned drills to contribute to the safe and reliable recovery of services.
• Performs additional tasks aligned with role expectations and qualifications to support team goals and operational flexibility.

Education

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Assurance, or related field.

Experience

• 5 years of relevant cybersecurity experience, preferably in a SOC, cyber defense operations, or incident analysis role.
• Hands-on experience with SIEM platforms (Sumo Logic or equivalent), EDR (CrowdStrike or equivalent), and security monitoring tools.

Additional experience may substitute for required education when it aligns with the competencies and knowledge necessary for the role:

• Associate’s degree in Cybersecurity, Computer Science, Information Technology, Information Assurance may substitute when accompanied by a minimum of 8 years of experience performing similar functions and at least 3 years of experience performing a previous position as Specialist role.
• High School or equivalent (GED) when accompanied by a minimum of 10 years of experience performing similar functions described and at least 5 years of experience performing a previous Specialist role.
• Networking & Traffic Analysis: Demonstrates strong understanding of TCP/IP, common protocols, firewall and VPN technologies, IDS/IPS systems, and the ability to analyze logs, review network traffic, and correlate security events.
• Operating Systems, Scripting & Forensics: Applies working knowledge of Windows and Linux OS environments, basic scripting in Python, PowerShell, or Bash, and foundational malware and digital forensics concepts.
• Cybersecurity Frameworks: Understands and applies cybersecurity frameworks such as NIST CSF, MITRE ATT&CK, and ISO 27001, along with defense‑in‑depth principles.
• Event Analysis & Security Monitoring: Possesses the ability to analyze logs, correlate events, and identify suspicious activity using technical knowledge and monitoring techniques.
• Analytical & Communication Skills: Demonstrates strong analytical and problem‑solving abilities, clear written and verbal communication in Spanish and English, attention to detail, teamwork, and high ethical standards under pressure.

Licenses/Certifications

At least one professional certification (or demonstrable equivalent):

• CySA+, or equivalent.
• CISSP, CEH, GCIA, GCIH, or GSEC is strongly valued.

Travel Requirements

• Not required

Physical Demands

• Stationary Position: Constantly
• Pushing/ Pulling/ Reaching: Seldom
• Kneel: Seldom
• Grab: Seldom
• Bend: Seldom
• Lift/Carry over: 0 - 15 lbs.

Working Conditions

• Wet or humid: Never
• Working near or on moving mechanical parts: Never
• Working near or on heavy machinery: Never
• Working in high places: Never
• Exposed to fumes or airborne particles: Never
• Frequency of working in outdoor weather conditions: Never
• Work with electricity: Never
• Loud noise conditions: Seldom

LUMA Energy is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, military status, disability, or any other characteristic protected by federal or local laws.