Cyber Security Operations Analyst - Cyber Security & TSOC

About the job

About the Opportunity

This position is within FirstEnergy Service Company and supports the Transmission Security Operations Center (TSOC). The TSOC provides 24x7 cybersecurity monitoring, investigation, response, and operational support across FirstEnergy's Information Technology, Operational Technology, Cyber Security, and Physical Security environments.

The Cyber Security Operations Analyst is responsible for identifying, investigating, documenting, escalating, and helping mitigate cybersecurity threats. Analysts operate across multiple security technologies and data sources, including SIEM, EDR/XDR, SOAR, OT security monitoring, threat intelligence, malware-analysis, and supporting investigative platforms.

This position requires strong analytical and troubleshooting capabilities, sound judgment, clear communication, and the ability to work both independently and collaboratively in a continuously evolving security environment.

Key Responsibilities

• Perform cybersecurity monitoring, alert triage, investigation, escalation, and response activities as part of a 24x7 security operation.
• Investigate activity across endpoint, identity, network, cloud, email, OT, and threat-intelligence data sources.
• Analyze Windows and Linux activity, authentication events, network traffic, email threats, malware, suspicious scripts, and other security telemetry.
• Develop and adapt KQL and SPL queries to validate findings, correlate evidence, identify related activity, and support investigation conclusions.
• Follow documented investigation methodologies while exercising judgment to determine when activity can be resolved within the TSOC or requires escalation.
• Document investigative actions, evidence, conclusions, mitigations, and escalations clearly enough that another analyst can reproduce and understand the investigation.
• Support incident-response activities, including evidence collection, containment and mitigation, investigative documentation, and coordination with senior analysts and incident responders.
• Participate in TSOC incident-response preparation, tabletop exercises, training, after-action activities, and continuous improvement efforts.
• Process suspected phishing, malicious-document, malware, identity, network, endpoint, cloud, and OT security events.
• Use threat intelligence and the MITRE ATT&CK framework to understand attacker behavior and improve investigations.
• Assist with or perform forensic analysis and evidence collection when required.
• Identify false positives, detection gaps, workflow failures, and opportunities to improve alert quality.
• Support security automation, SOAR playbooks, detection content, dashboards, reporting, metrics, procedures, and knowledge documentation.
• Monitor and identify issues affecting the TSOC investigation workflow or security-tool ecosystem and escalate operational problems appropriately.
• Collaborate with other FirstEnergy Cyber Security, IT, OT, compliance, and business teams during investigations and security initiatives.
• Maintain awareness of the current threat landscape and emerging attacker techniques.
• Participate in projects and continuous-improvement efforts that mature TSOC capabilities.
• As experience increases, provide case review, mentoring, training, process ownership, platform support, project leadership, and technical escalation for less-experienced analysts.

Required Qualifications

Candidates should demonstrate an appropriate combination of education, IT experience, cybersecurity experience, and practical technical capability.

• Foundational understanding of cybersecurity principles and security operations.
• Understanding of Windows operating systems and common security-relevant Windows events.
• Familiarity with Linux operating systems.
• Understanding of networking fundamentals including TCP/IP, DNS, HTTP/S, network addressing, and common network protocols.
• Familiarity with SIEM, EDR/XDR, SOAR, or comparable security technologies.
• Understanding of alert triage and cybersecurity investigation methodology.
• Familiarity with common cybersecurity threats including phishing, credential compromise, malware, suspicious scripting, and attacker persistence techniques.
• Foundational understanding of MITRE ATT&CK and attacker tactics, techniques, and procedures.
• Ability to interpret or develop basic scripts and queries using technologies such as PowerShell, Python, Bash, KQL, or SPL.
• Strong analytical, troubleshooting, and problem-solving skills.
• Strong written and verbal communication skills.
• Ability to clearly document technical investigative findings.
• Ability to appropriately handle confidential and security-sensitive information.
• Ability to learn independently while also knowing when to collaborate or escalate.
• Ability to work effectively in an environment where operational priorities may change rapidly.
• Ability to work independently with appropriate judgment and minimal supervision.

Preferred Qualifications

• Previous SOC, cybersecurity operations, incident-response, system administration, networking, IT support, or related technical experience.
• Experience with SIEM / TIP / SOAR / OT Monitoring, or similar security technologies.
• Experience investigating phishing, malware, identity, endpoint, network, cloud, or OT security events.
• Experience with KQL, SPL, PowerShell, Python, or other query/scripting languages.
• Familiarity with ICS/OT cybersecurity concepts.
• Familiarity with digital forensics or malware-analysis concepts.
• Experience working with security metrics, dashboards, detection engineering, or automation.
• Certifications such as CompTIA Security+, CySA+, Microsoft SC-200, Splunk Certified Cybersecurity Defense Analyst, or equivalent practical experience.

Schedule / Operational Requirements

• TSOC provides 24x7 security monitoring, so positions assigned to console operations will include day and night coverage as well as 12-hour shifts.
• Analysts must be able to respond appropriately to security events originating from multiple monitoring and communication channels.
• Analysts are expected to maintain situational awareness during assigned operational coverage and follow established shift-handoff and escalation procedures.
• Participation in incident-response activities or other critical cybersecurity events may occasionally be required outside normal schedules depending upon level and assigned responsibilities.

Benefits, Compensation & Workforce Diversity

At FirstEnergy, employees are key to our success. We depend on their talents to meet the challenges of our changing business environment. We are committed to rewarding individual and team efforts through our total rewards philosophy which includes competitive pay plus incentive compensation, a company-sponsored pension plan, 401(k) savings plan with matching employer contribution, a choice of medical, prescription drug, dental, vision, and life insurance programs, as well as skills development training with tuition reimbursement. Please visit our website at www.firstenergycorp.com to learn more about all of our employee rewards programs. FirstEnergy proudly supports workforce diversity. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status as a protected veteran, or status as a qualified individual with a disability. No recruiters or agencies without a previously signed contract. Unable to sponsor or transfer H-1B visas at this time.

Safety

Safety is a core value for FirstEnergy and is essential to all of our business activities. We ensure employees have the tools, information, and processes to perform their duties in a manner that assures safety for themselves, their co-workers, our customers and the public. Our goals are to provide a safe work environment, to maintain an accident-free, injury-free workplace, and to promote and maintain public safety. To meet these goals, we dedicate ourselves to achieving world-class safety standards.

Position Classification

Exempt

FirstEnergy Human Resources Team

Additional Information

• Job Identification: 105910
• Job Category: Cyber Security Operations Analyst
• Posting Date: 2026-11-13
• Apply Before: 2026-11-30
• Job Schedule: Full time
• Residence Requirements: Must reside in FE service territory and within 60 minutes of FE corporate location
• Referral Bonus Eligible: No
• Referral Bonus Amount: 0