IT Security Engineer

Atmos Energy Corporation; United States; On-site; USD 110,000 - 150,000; Full time

Job summary

Atmos Energy Corporation is actively seeking a security-focused professional to manage SIEM, analyze incidents from diverse sources, and guide responders through containment and resolution. The role demands independent thinking to separate genuine threats from false alarms and to develop actionable investigations.

Responsibilities include incident reporting, deploying security controls, and maintaining up-to-date threat knowledge.

Qualifications

• Bachelor's degree in Computer Science or related field and 4+ years in information security.
• Experience on CIRT/CERT/CSIRC or SOC preferred.
• Proficient with SIEM solutions, vulnerability management, log analysis, and network security concepts.
• Experience with scripting (Python, Unix tools) and security incident handling.

Responsibilities

• Manages SIEM and analyzes incidents from multiple sources for severity and risk.
• Prioritizes incidents and advises responders on investigation steps.
• Identifies, reports and resolves security incidents with resources.
• Composes security alert notifications and deploys controls to detect events.
• Maintains knowledge of threats and trends from ICS-CERT and related bodies.
• Develops periodic reporting and trend analyses; tunes to reduce false positives.
• Writes programs and routines to automate security triage tasks.
• Acts as interface between users and IT engineering/security operations.
• Participates in planning and execution of contracted services with outside vendors.

Skills

CIRT/SOC experience

SIEM administration

Incident response

Network traffic analysis

Python scripting

Unix/Linux and Windows

Vulnerability assessment

PCI/compliance knowledge

Communication skills

Education

Bachelor's degree in Computer Science or related field

Tools

SIEM (LogRhythm)

Forensics tools

Vulnerability tools

Job description

THIS JOB DESCRIPTION DOES NOT ATTEMPT TO LIST ALL OF THE DUTIES THAT ARE OR MAY BE PERFORMED IN THIS POSITION

Primary Duties

1. 1. Manages SIEM and performs analyses of incidents from multiple sources for severity and risk. Performs network traffic and log analyses. Additionally, performs configuration and administration of the SIEM environment including but not limited to installation of new agents, configuration of alerts and rules, reporting, and overall health of the system.
2. 2. Exercises independent thinking to prioritize and differentiate between potential intrusion attempts and false alarms. Advises incident responders in the steps to investigate and resolve computer security incidents.
3. 3. Identifies, reports and resolves security incidents. Determines appropriate resources needed to resolve incidents and works with resources to identify malicious activity. Creates and tracks investigations through resolution.
4. 4. Composes security alert notifications. Deploys and maintains security controls within the network environment to help prevent and detect security events.
5. 5. Maintains up-to-date knowledge of information technology related trends, external threats, current vulnerabilities, attacks, and countermeasures as they are published from organizations such asICS-CERT.
6. 6. Develops periodic reporting and trend analysis of identified issues and aides in tuning to reduce false positives. Collects and tracks incident metrics related to IT security.
7. 7. Writes and implements programs and routines in various scripting languages to improve and automate security triage tasks.
8. 8. Acts as secondary interface between users and IT engineering and security operations.
9. 9. Participates in the planning and execution of contracted services with outside vendors (e.g., security monitoring and analytical services).

MINIMUM REQUIREMENTS & SKILLS

• Educational/Experience Level: Bachelor's degree in Computer Science or a closely related field and four years related experience in Information Security, or equivalent.
• Computer Skills: Strongly Preferred Skills: 1. Experience on a computer incident response Team (CIRT), computer emergency response team (CERT), computer security incident response center (CSIRC) or a security operations center (SOC).
• 2. Experience with anti-virus, intrusion detection systems, firewalls, active directory, vulnerability assessment tools and other security tools found in large network environments; along with experience working with security information and event management (SIEM) solutions.
• 3. Experience with vulnerability management, log management, analysis, and monitoring, virtual private networks, virtualization, firewalls, web application security concepts and intrusion detection/prevention systems.
• 4. Shell scripting experience with unix tools (sed, awk, grep, etc) and Python
• 5. Experience with syslog technologies (e.g., syslog-ng, rsyslog, Snare and SIEM technologies).
• 6. Strong technical background in operating systems (UNIX/Linux, Windows), internet applications (electronic mail, web, DNS/DHCP, TCP/IP), desktop software (Microsoft Office, virus detection programs), encryption (SSL, TLS, IPSEC) and networking hardware and software.
• 7. Understanding of protocols and standards such as TCP/IP, LDAP and 802.1x and network management tools such as SNMP, and NIST.
• 8. Knowledge of local and federal law enforcement practices, procedures, and evidential chain of custody, as related to IT security incidents.
• 9. Strong knowledge of network PCAP analysis tools (ex, WireShark).
• 10. Knowledge of LogRhythm or compairable SIEM technologies.
• 11. Understanding of the Lockheed kill chain and analysis of each stage.
• 12. Experience with Forensics tools such as Volatility, Encase, etc
• 13. Knowledge of PCI compliance and performing triage within a PCI environment is a plus.
• Additional Relevant Skills: 1. Professional security certification (i.e., CEH, CISSP, ISSP, SSCP, GIAC, etc.).
• 2. Experience within the Department of Homeland Security or other government agencies.
• 3. Experience with digital media analysis (DMA) and computer forensics.
• 4. Background in utility scripting and programming (Python, Powershell and Bash) and network operations.
• Communication Skills: Requires the ability to communicate effectively and the skills to inform, persuade and/or influence internal and/or external customers and senior management on matters of a technical and/or complex nature.
• Numeric Skills: Requires the ability to perform analyses involving ratios, percentages and simple statistical methods.
• Work Conditions: Works in an office environment. Must be available to respond to emergency security incidents outside of normal business hours. Requires occasionally performing activities including, but not limited to, bending, stooping, grasping, reaching, twisting, turning and/or lifting.

Atmos Energy Corporation is an Equal Opportunity Employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, or veteran status.

Job Family: Cybersecurity Atmos Energy Corporation, a natural gas-only distributor, is an S&P 500 company headquartered in Dallas. We safely deliver reliable, affordable, efficient and abundant natural gas to more than 3 million distribution customers in over 1,400 communities across eight states located primarily in the South. As part of our vision to be the safest provider of natural gas services, we are modernizing our business and infrastructure while continuing to invest in safety, innovation, environmental sustainability and our communities. Atmos Energy manages proprietary pipeline and storage assets, including one of the largest intrastate natural gas pipeline systems in Texas.