Information Security Analyst I - III

Entergy is seeking an Information Security Analyst I, II, or III to join its Cybersecurity Organization and Consolidated Security Operations Center. The role is responsible for investigating and responding to security incidents, analyzing threats and attack vectors, improving security operations, supporting threat hunting, and helping protect critical infrastructure and operational assets.

What you'll do:

• Understanding of digital evidence and forensic analysis
• Assist in continuously improving the existing daily operational and incident response procedures and playbooks
• Identify automation opportunities to improve capabilities
• Identify problematic trends and take proactive steps to mitigate negative impacts to customer base
• Conduct investigations and understand security incidents, including but not limited to, malware infections, phishing attempts, and unauthorized access attempts
• Analyze and understand various attack vectors used by threat actors to compromise systems and data
• Monitor and assess the threat landscape to identify emerging threats and vulnerabilities relevant to our environment
• Knowledge of using SIEM tools with possible areas of development and upkeep of detections
• Maintain understanding of the various threats and risks related to utility workforce, energy providers and/or NERC/CIP
• Monitor and participate in training and exercises to ensure CSOC team proficiency
• Participate in post-incident reviews to identify lessons learned and best practices
• Ability to work in network investigations to identify and mitigate potential security risks and intrusions

What they're looking for:

• Typically requires an associate's degree or university degree in related field (i.e. Cybersecurity, Information security, criminal justice, computer science, etc.) or the equivalent work experience
• 0 to 1+ years of security experience, across multiple disciplines (incident response, threat hunting, monitoring, crisis management, log gathering, event correlation, configuration, behavior analytics, network engineering data analytics, application security, database security, risk management, project management, physical security, etc.). Typically requires an associate's degree or university degree in related field (i.e. Cybersecurity, Information security, criminal justice, computer science, etc.) or the equivalent work experience
• 2+ years of cybersecurity experience, across multiple disciplines (playbook development, incident response, threat hunting, monitoring, crisis management, log gathering, event correlation, configuration, behavior analytics, network engineering data analytics, application security, database security, risk management, project management, physical security, etc.) experience can be substituted with education as follows:
• Associate degree in cybersecurity or related field and 1+ years of experience
• 5+ years of cyber security experience, across multiple disciplines (playbook development, incident response, threat hunting, monitoring, log gathering, event correlation, configuration, behavior analytics, network engineering data analytics, application security, database security, risk management, project management, physical security, etc.) experience can be substituted with education as follows:
• Bachelor's degree in cybersecurity and 3+ years of experience
• 3 years of hands-on experience working with Security Incident and Event Management, incident response in a SOC environment with a structured after-hours process
• Hands-on experience working with Security Information Event Management (SIEM), event and incident investigations and incident response in a 24/7 SOC environment
• Ability to work effectively with team members and with customers
• Knowledge of various attack vectors, threat intelligence sources, and the cybersecurity threat landscape
• Experience to include some of the following: access control, CCTV, network investigations, intrusion detection systems (IDS), and/or security information and event management (SIEM) tools
• Understanding of Cloud (SaaS, IaaS, PaaS), Industrial Control Systems (ICS) and Operational Technology (OT) security principles and best practices

Benefits:

• Hybrid work arrangement