Sargent & Lundy is a leading consulting engineering firm specializing in the power and energy sectors. Since 1891, we have provided comprehensive engineering, design, and consulting services for both traditional and renewable power generation, grid modernization, nuclear power, and beyond. Our mission is to help clients achieve their energy goals effectively by leveraging advanced technologies and adopting sustainable practices.

Role Overview

The Senior Information Security Analyst - Security Operations acts as the technical and process subject matter expert on the Security Operations team. This is a "playercoach" role designed for a highlevel individual contributor who possesses deep technical expertise in Security Events and Information Management (SIEM), Security Operations (SOC) Management, incident response, and Vulnerabilities Management, while also providing technical leadership and mentorship to junior analysts and interns.

The successful candidate will bridge the gap between highlevel strategy and handson execution, ensuring our outsourced SOC vendor delivers highquality results. You will design, maintain, and interpret KPI/KRI dashboards that track SOC performance, vulnerability risk, incident trends, and control effectiveness, providing executiveready reporting that drives accountability and informs leadership decisions.

Core Responsibilities

Vulnerability & Threat Management
Program Technical Lead: Manage the endtoend vulnerability management lifecycle and direct the technical configurations and roadmap for the Qualys vulnerabilities scanning platform, ensuring comprehensive coverage across onprem, cloud, and remote endpoints.
Advanced Analysis and Stakeholder Coordination: Move beyond automated reporting to perform deepdive analysis on complex vulnerabilities and coordinate with IT infrastructure and application owners for prioritization and creative remediation of vulnerabilities.
Threat Intelligence Integration: Translate global threat intelligence into actionable Qualys scans and search queries to proactively identify "atrisk" assets.
SIEM/SOC Management & Coordination
Vendor Technical Oversight: Act as the primary technical point of contact for the outsourced SOC provider (CrowdStrike, Cortex XSIAM platform). Hold the vendor accountable to defined Service Level Agreements (SLAs) and Key Performance Indicators (KPIs). Conduct weekly quality reviews of their "True Positive" alerts and provide feedback on their analysis.
SIEM Governance: Maintain complete visibility into SIEM architecture (Splunk Cortex XSIAM platform). Ensure all critical log sources are properly ingested and parsed. You will own the logonboarding process and validate that the SOC is receiving the telemetry they need to be effective.
Rule Tuning: Collaborate with the SOC vendor to finetune correlation rules and use cases to reduce "noise" (false positives) while ensuring highfidelity detection of "true positives."
Reporting: Design and review executive dashboards that provide visibility into the health of the security environment and SOC performance.
Incident Management & Response
Lead Responder: Serve as the senior technical lead during active security incidents, guiding junior staff through containment and eradication steps.
Incident Life Cycle Management: Drive technical investigation, containment, and eradication phases. Lead "Lessons Learned" sessions following major incidents to identify root causes and implement preventative controls.
Playbook Development: Design and maintain technical incident response playbooks that the junior team can follow during initial triage.
Forensic Coordination and Oversight: Manage forensic data collection and analysis, whether performed internally or through a thirdparty partner.
Operational Readiness: Lead tabletop simulations for the internal team to build "muscle memory" for highpressure scenarios.
Drive data analysis, dashboards, and executive reporting
Design, build, and maintain operational and executive dashboards (e.g., in SIEM tools, PowerBI, or Excel) that track:
SOC performance (SLAs, MTTR, true/false positive rates)
Vulnerability posture (exposure, remediation timelines, risk trends)
Incident patterns, root causes, and control effectiveness
Translate data into clear insights and narratives for leadership, highlighting risk, performance, and trends, and recommending actions to improve security posture.
Automate metrics and reporting wherever possible to ensure repeatability, accuracy, and timely visibility.
Security Resiliency & Continuity
Resilience Engineering: Evaluate current security controls to identify "single points of failure" and propose architectural changes to improve the organization's ability to withstand attacks.
Business Continuity (BCP) and Disaster Recovery (DR) Support: Collaborate with business units to ensure security controls support the Business Impact Analysis (BIA) and recovery objectives. Partner with the Disaster Recovery team to ensure security tools are functional during recovery/failover scenarios.
Mentorship & Technical Leadership
Team Development: Provide daily technical guidance to junior analysts and interns (a team of 2 to 5). Conduct reviews of their analysis and help them grow their technical skill sets.
Knowledge Base: Maintain a highquality internal Knowledge Base for security operations procedures.
Process Optimization: Identify manual tasks performed by the team and lead automation efforts to improve efficiency.

TalentAlly

Latest Jobs

SOC Analyst