Cybersecurity Operations Engineer

As the nation’s first statewide, “transmission only” company, VELCO manages the safe, reliable, cost-effective transmission of electric power throughout Vermont and as a part of the integrated New England regional network.

At VELCO, cybersecurity is essential to maintaining a reliable and resilient electric grid. As a Cybersecurity Operations Engineer, you will play a critical role in protecting VELCO’s corporate technology environment from evolving cyber threats while supporting the secure delivery of the technology and services our organization depends on.

If you enjoy solving complex problems, investigating suspicious activity, improving security capabilities, and working with a team committed to protecting critical infrastructure, this is an opportunity to make a meaningful impact.

This role combines hands-on security operations, incident response, threat analysis, vulnerability management, security engineering, and regulatory compliance. You will work across endpoints, identities, networks, servers, cloud services, applications, and third-party connections while partnering with Information Security, IT Infrastructure, business teams, Compliance, Legal, Human Resources, and other stakeholders.

You will also contribute to VELCO’s NERC CIP cybersecurity program, including cybersecurity incident response activities under CIP-008, internal network security monitoring under CIP-015, and risk assessment support under CIP-013.

The Cybersecurity Operations Engineer is expected to independently complete assigned operational and compliance-support activities, apply sound judgment during security events, and elevate material risks promptly. The role performs complex security analysis, develops repeatable operational procedures, maintains defensible records, and contributes to continuous improvement of VELCO’s corporate cybersecurity program. The position typically requires progressively responsible experience sufficient to operate with limited oversight while collaborating effectively across technical and business functions.

• Monitor and triage security alerts from corporate endpoints, identity platforms, networks, servers, cloud services, email, applications, and other enterprise security technologies.
• Investigate suspicious activity, validate the scope and severity of events, document findings, coordinate containment and remediation, and elevate incidents in accordance with VELCO procedures.
• Participate in VELCO’s cybersecurity incident response program and NERC CIP-008 activities, including preparation, testing, event classification support, evidence preservation, response coordination, recovery, lessons learned, and maintenance of incident records.
• Participate in NERC CIP-015 internal network security monitoring activities, including support for monitoring strategy, sensor and data-source coverage, alert review, analysis, escalation, evidence retention, testing, and documented process improvement.
• Administer and improve corporate security operations tools such as security information and event management, endpoint detection and response, email security, vulnerability management, identity protection, network monitoring, and security orchestration technologies.
• Develop and tune detections, dashboards, correlation rules, use cases, playbooks, and response procedures to improve visibility and reduce response time while managing false positives.
• Conduct vulnerability assessment and remediation coordination for corporate systems; validate risk, establish priorities with system owners, track corrective actions, and report unresolved exposure.
• Support identity and access security through review of privileged activity, authentication…