Cybersecurity Analyst — PowerGrid Services, Hartselle, AL

What You’ll Do

Vulnerability and Exposure Management

• Run Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.

• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.

• Validate patches and configuration fixes, and manage exceptions through our documented risk-acceptance process.

Alert Triage and Response

• Work alerts from Rapid7 InsightIDR, SentinelOne, and Microsoft Defender, and coordinate with our 24x7 SOC on escalations.

• Flag noisy or low-value detections to the engineering team so they can be tuned.

• Support incident response by handling initial triage and containment steps per our playbooks, documenting findings, and contributing to post-incident reviews.

Endpoint Security

• Handle day-to-day SentinelOne console work: policies, exclusions, device groups, and agent health.

• Investigate threats using SentinelOne Deep Visibility and Storyline data, and perform remediation and rollback when needed.

• Work with the engineering team and Intune and Defender administrators to avoid policy gaps and conflicts.

Email Security

• Handle daily Barracuda Email Protection work: quarantine management, allow and block lists, and impersonation and phishing alerts.

• Investigate reported phishing and suspicious messages, and remove malicious email from affected mailboxes.

• Pass false positive and tuning findings to the engineering team, and support security awareness efforts with phishing trends and simulation results.

Microsoft Environment

• Review Entra ID, Active Directory, and Microsoft 365 security findings, including Secure Score and CIS benchmark gaps, and apply approved changes.

• Monitor DLP and sensitivity label alerts and handle policy match reviews.

• Partner with the infrastructure team on remediation items.

Documentation and Reporting

• Write and maintain runbooks, incident playbooks, and procedures.

• Collect evidence and support audit and compliance requests.

• Produce clear metrics and status reports for IT leadership.

• Participate in an on-call rotation for security incidents.

What You Bring

• 2 to 4 years of hands-on experience in security operations, security analysis, or a closely related IT security role.

• Experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.

• Hands-on experience with SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.

• Experience with Barracuda or another email security gateway such as Proofpoint, Mimecast, or Check Point, and a working understanding of SPF, DKIM, and DMARC.

• Working knowledge of the Microsoft ecosystem: Active Directory, Entra ID, Microsoft 365, Intune, and Windows Server.

• Working knowledge of networking (TCP/IP, DNS, firewalls, VPN) and common attack techniques, including MITRE ATT&CK.

• Experience investigating incidents and documenting findings clearly for technical and non-technical audiences.

• Basic PowerShell scripting ability, or a willingness to learn.

• Bachelor’s degree in cybersecurity, computer science, IT, or a related field, or equivalent experience.

Nice to Have

• Familiarity with NERC CIP or other critical infrastructure compliance requirements.

• Exposure to OT/ICS environments.

• Experience with Microsoft Sentinel, KQL, or SOAR automation.

• Knowledge of NIST CSF, NIST 800-53, or CIS Controls.

• Interest in AI security and governance, including securing enterprise AI tools and managing unsanctioned AI apps.

• Certifications such as Security+, CySA+, GCIH, GSEC, SC-200, AZ-500, or CISSP (or progress toward one).