EMS Security Analyst

Protect critical energy operations with deep network visibility while contributing to regulatory-ready security for EMS and OT environments. This in-office role in Birmingham, AL supports network security monitoring for enterprise and SCADA networks, helping improve detection quality, reduce false positives, and prioritize operationally significant risk. You will also contribute to compliance evidence and audit support tied to NERC CIP, FERC, SERC, Sarbanes-Oxley, and other applicable requirements.

What you’ll do

• Administer and support network security monitoring platforms, sensors, management systems, and supporting infrastructure across EMS/SCADA and OT environments.
• Design, configure, and maintain network visibility architecture, including traffic aggregation, packet brokering, network taps, span monitoring, sensor placement, and secure data flows.
• Monitor and analyze network communications to identify assets, protocols, dependencies, anomalous activity, unauthorized changes, misconfigurations, and potential cyber threats.
• Develop and tune detections, alerts, baselines, policies, and asset classifications to improve monitoring accuracy, reduce false positives, and focus on significant risk.
• Support packet capture, metadata collection, log forwarding, and integrations with enterprise security monitoring, incident response, vulnerability management, and reporting capabilities.
• Partner with EMS, network, infrastructure, application, and cybersecurity subject matter experts to validate network behavior, strengthen segmentation, reduce unnecessary communications, and improve security posture.
• Investigate, troubleshoot, and resolve security monitoring and network visibility issues while minimizing operational impact to EMS and SCADA environments.
• Perform threat hunting, event triage, and incident investigation using network telemetry, packet-level evidence, asset context, and other available security data.
• Evaluate emerging OT security and network visibility technologies and recommend options aligned with EMS cybersecurity strategy, architecture, operational goals, and compliance needs.
• Maintain monitoring evidence, documentation, procedures, and technical controls to support compliance initiatives and audits for NERC CIP, FERC, SERC, Sarbanes-Oxley, and other applicable regulatory requirements.
• Build automation, reporting, health monitoring, and operational efficiencies using Python, PowerShell, Perl, or shell scripting.

What you bring

• Degree in computer science, cybersecurity, information systems, electrical engineering, or equivalent experience.
• Five (5) years of cybersecurity experience.
• Industry certification preferred: CISSP, CISA, CISM, GICSP, or equivalent experience.
• Hands-on experience in OT cybersecurity, network security monitoring, traffic analysis, or related security functions is preferred.
• Experience with OT security monitoring and network visibility, including packet capture and traffic analysis, using platforms such as Dragos, Nozomi, Claroty, Riverbed, or comparable tools.
• Understanding of cybersecurity principles, EMS/SCADA operations, network architecture, common network protocols, and business objectives required to support secure and reliable operations.
• Strong analytical and troubleshooting skills, with the ability to distinguish expected operational behavior from potentially malicious or unauthorized activity.
• Ability to manage multiple priorities and adapt to changing operational requirements while protecting availability and reliability of critical systems.
• Strong organization skills to quickly learn, evaluate, document, and apply new technologies and monitoring methods.
• Excellent verbal and written communication skills to communicate findings, operational risk, and recommended actions to technical and non-technical audiences.

Technologies you may use

• Python, PowerShell, Perl, shell scripting
• Dragos, Nozomi, Claroty, Riverbed
• CISSP, CISA, CISM, GICSP

Benefits

• Competitive base salary
• Annual incentive awards for eligible employees
• Health, welfare and retirement benefits
• Additional details about total compensation and benefits provided during the hiring process
• Benefits summary available at: https://seo.nlx.org/southernco/pdf/SOCO-Benefits.pdf

Location and work setting

In-office role in Birmingham, AL.

Insider Threat Program

This position falls under the company’s Insider Threat Program and will have access to, and control over, sensitive data, systems, or assets. Enhanced personnel screening, including a background review, drug screen, and psychological assessment, will be required if selected.

How you’ll work

• Demonstrate behaviors consistent with Southern Company’s Values and commitment to customer service.
• Be proactive, self-motivated, and accountable with a strong sense of ownership and follow-through.
• Build and maintain effective working relationships with team members, customers, and stakeholders across the organization.
• Exhibit initiative, adaptability, and a collaborative approach to team and organizational objectives.