Lead Cyber Defense & Incident Response

Iberdrola; New York (NY); On-site; USD 117,000 - 146,000; Full time

Benefits offered by this job

Competitive benefits and growth

12% 401(k) match

Tuition reimbursement

Professional development

Job summary

ROCHESTER GAS & ELEC CORP is seeking a Lead Cyber Detect & Response Specialist to drive detection and response across Avangrid’s OSG and related units. You will guide incident lifecycle activities, mentor staff, and coordinate across IT/OT teams to implement secure, monitored defenses.

The role emphasizes advanced investigations, playbook development, and proactive threat research to minimize production downtime and risk exposure in a highly regulated utility environment.

Qualifications

• Master’s Degree in Engineering, Computer Science, or technical related degree with a minimum of 6+ years’ experience in Cybersecurity.
• Bachelor’s Degree in Engineering, Computer Science, or technical related degree with a minimum of 8+ years’ experience in Cybersecurity.
• Associate Degree in Engineering, Computer Science, or technical related degree with a minimum of 10+ years’ experience in Cybersecurity.
• 3+ years of Information Security experience.
• Hands‑on troubleshooting, analysis, and technical expertise to resolve incidents and service requests; previous experience in troubleshooting day‑to‑day operational processes such as security monitoring, data correlation, security operations, etc.
• Proven experience performing analysis of security events and incidents, to determine root cause and provide resolution.
• Strong working knowledge of at least three of the following security tools: host‑based antivirus, anti‑spam gateway solutions, firewalls, IDS/IPS, server and network device hardening, data loss prevention, forensics software, vulnerability management, website security.
• Competence in using both internal and external ticketing systems for incident, problem & change management.
• Excellent oral and written communication skill.
• Experience working with Cyber Threat Intelligence, Threat Defense and Hunting teams.
• Customer oriented leader capable of communicating to technical and business unit stakeholders.
• Experience with Access Controls systems and solutions (SSO, AD, TACACS, MFA, cloud based).
• Experience with a variety of information and network security infrastructure and tools (SIEM, IDS/IPS, firewall, WAF, configuration management).
• Experience with key security process and procedures (system hardening, patch management, vulnerability management, log management, access controls, supplier management, information classification/handling).
• Experience with common security operations services (access management, electronic perimeter management, baseline management, vulnerability assessments).

Responsibilities

• Lead the development and deployment of security services and solutions in support of Avangrid’s evolution towards a zero‑trust security framework.
• Assist in establishing a security incident detection and response program for OSG that is well defined, highly available, repeatable, and is constantly measured for Key performance, Key risk, and Key operational level metrics.
• Identify, respond, and mitigate threats to Avangrid and its affiliated entities.
• Conduct incident response activities, including advanced investigation (forensic, malware analyses, root cause analysis etc.) to investigate potential intrusions and develop remediation guidance.
• Perform the activities necessary for the immediate, short‑term rapid resolution of incidents to minimize risk exposure and production down‑time.
• Maintain a professional communicative relationship with clients and management to provide information throughout the incident, problem, and change management cycles.
• Coordinate and drive efforts among multiple IT and OT business units during response activities and post‑mortem.
• Proactive monitoring of internal and external‑facing environment using specialized security applications.
• Provide timely, comprehensive, and accurate information to OSG leadership in both written and verbal communication.
• Proactively research and monitor security‑related information sources to aid in the identification of threats to Avangrid networks, systems and Avangrid control systems.
• Mentor and develop other staff members on incident response, analysis, and tools.
• Routinely develop and update incident response playbooks to ensure response activities align with best practices, minimize gaps in response and provide comprehensive mitigation of threats.
• Participate and develop security incident and penetration testing procedures including penetration testing criteria, performance of testing, and implementation of lessons learned.

Skills

Incident response

Threat detection

Leadership

Communication

Team coordination

Education

Master's in Engineering/CS

Bachelor's in Engineering/CS

Associate in Engineering/CS

Tools

SIEM

Firewalls

IDS/IPS

Job description

ROCHESTER GAS & ELEC CORP is seeking a Lead Cyber Detect & Response Specialist to drive detection and response across Avangrid’s OSG and related units. You will guide incident lifecycle activities, mentor staff, and coordinate across IT/OT teams to implement secure, monitored defenses.

The role emphasizes advanced investigations, playbook development, and proactive threat research to minimize production downtime and risk exposure in a highly regulated utility environment.