EMS Security Analyst

Location:

This is an in-office position in Birmingham, AL.

The successful candidate will serve as a key contributor to network security monitoring functions supporting critical Energy Management System (EMS) and operational technology (OT) environments. Responsibilities include deploying, administering, and optimizing network security monitoring capabilities; maintaining asset and communication visibility; analyzing enterprise and SCADA system network activity; supporting threat detection and incident investigation; and meeting cybersecurity and compliance requirements within a highly regulated NERC CIP environment.

• Degree in computer science, cybersecurity, information systems, electrical engineering, or equivalent experience.
• Industry certification preferred (CISSP, CISA, CISM, GICSP, or equivalent experience).
• Minimum of five (5) years of cybersecurity experience. Hands-on experience in OT cybersecurity, network security monitoring, traffic analysis, or related security functions is preferred.

• Administer and support network security monitoring platforms, sensors, management systems, and supporting infrastructure across EMS/SCADA and OT environments.
• Design, configure, and maintain network visibility architecture, including traffic aggregation, packet brokering, network taps, span monitoring, sensor placement, and secure data flows.
• Monitor and analyze network communications to identify assets, protocols, dependencies, anomalous activity, unauthorized changes, misconfigurations, and potential cyber threats.
• Develop and tune detections, alerts, baselines, policies, and asset classifications to improve monitoring accuracy, reduce false positives, and prioritize operationally significant risk.
• Support packet capture, metadata collection, log forwarding, and integrations with enterprise security monitoring, incident response, vulnerability management, and reporting capabilities.
• Partner with EMS, network, infrastructure, application, and cybersecurity subject matter experts to validate network behavior, strengthen segmentation, reduce unnecessary communications, and improve the security posture of critical systems.
• Investigate, troubleshoot, and resolve security monitoring and network visibility issues while minimizing operational impact to EMS and SCADA environments.
• Perform threat hunting, event triage, and incident investigation using network telemetry, packet-level evidence, asset context, and other available security data.
• Evaluate emerging OT security and network visibility technologies and provide recommendations that support EMS cybersecurity strategy, architecture, operational, and compliance objectives.
• Support compliance initiatives and audits related to NERC CIP, FERC, SERC, Sarbanes-Oxley, and other applicable regulatory requirements by maintaining monitoring evidence, documentation, procedures, and technical controls.
• Develop and maintain automation, reporting, health monitoring, and operational efficiencies through scripting and tools utilizing Python, Power Shell, Perl, or shell scripting.

• Experience with OT security monitoring, network visibility, packet capture, traffic analysis, or similar platforms such as Dragos, Nozomi, Claroty, Riverbed, or comparable tools.
• Understanding of cybersecurity principles, EMS/SCADA operations, network architecture, common network protocols, and business objectives required to support secure and reliable operations.
• Strong analytical, critical-thinking, problem-solving, and troubleshooting skills, with the ability to distinguish expected operational behavior from potentially malicious or unauthorized activity.
• Ability to manage multiple priorities and adapt to changing operational requirements while protecting the availability and reliability of critical systems.
• Strong organizational skills with the ability to quickly learn, evaluate, document, and apply new technologies and monitoring methods.
• Excellent verbal and written communication skills with the ability to communicate technical findings, operational risk, and recommended actions to technical and non-technical audiences.

• Demonstrate behaviors consistent with Southern Company's Values and commitment to customer service.
• Be proactive, self-motivated, and accountable, with a strong sense of ownership and follow-through.
• Build and maintain effective working…