{"id":4286156,"url":"https://alion.io/job/firstenergy-cyber-security-operations-analyst-cyber-security-tsoc","title":"Cyber Security Operations Analyst - Cyber Security & TSOC","company":{"id":1755196,"name":"FirstEnergy","domain":"firstenergycorp.com","url":"https://alion.io/company/firstenergycorp","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":78,"open_postings":73,"ghost_share":0,"stale_share":0.849,"repost_share":0.041,"time_to_fill_p50_days":31,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Akron, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"DNS","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-11-13T20:28:50Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T21:54:44Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About the Opportunity\nThis position is within FirstEnergy Service Company and supports the Transmission Security Operations Center (TSOC). The TSOC provides 24x7 cybersecurity monitoring, investigation, response, and operational support across FirstEnergy's Information Technology, Operational Technology, Cyber Security, and Physical Security environments.\nThe Cyber Security Operations Analyst is responsible for identifying, investigating, documenting, escalating, and helping mitigate cybersecurity threats. Analysts operate across multiple security technologies and data sources, including SIEM, EDR/XDR, SOAR, OT security monitoring, threat intelligence, malware-analysis, and supporting investigative platforms.\nThis position requires strong analytical and troubleshooting capabilities, sound judgment, clear communication, and the ability to work both independently and collaboratively in a continuously evolving security environment.\nKey Responsibilities\nPerform cybersecurity monitoring, alert triage, investigation, escalation, and response activities as part of a 24x7 security operation.\nInvestigate activity across endpoint, identity, network, cloud, email, OT, and threat-intelligence data sources.\nAnalyze Windows and Linux activity, authentication events, network traffic, email threats, malware, suspicious scripts, and other security telemetry.\nDevelop and adapt KQL and SPL queries to validate findings, correlate evidence, identify related activity, and support investigation conclusions. \nFollow documented investigation methodologies while exercising judgment to determine when activity can be resolved within the TSOC or requires escalation.\nDocument investigative actions, evidence, conclusions, mitigations, and escalations clearly enough that another analyst can reproduce and understand the investigation.\nSupport incident-response activities, including evidence collection, containment and mitigation, investigative documentation, and coordination with senior analysts and incident responders.\nParticipate in TSOC incident-response preparation, tabletop exercises, training, after-action activities, and continuous improvement efforts.\nProcess suspected phishing, malicious-document, malware, identity, network, endpoint, cloud, and OT security events.\nUse threat intelligence and the MITRE ATT&CK framework to understand attacker behavior and improve investigations.\nAssist with or perform forensic analysis and evidence collection when required.\nIdentify false positives, detection gaps, workflow failures, and opportunities to improve alert quality.\nSupport security automation, SOAR playbooks, detection content, dashboards, reporting, metrics, procedures, and knowledge documentation.\nMonitor and identify issues affecting the TSOC investigation workflow or security-tool ecosystem and escalate operational problems appropriately.\nCollaborate with other FirstEnergy Cyber Security, IT, OT, compliance, and business teams during investigations and security initiatives.\nMaintain awareness of the current threat landscape and emerging attacker techniques.\nParticipate in projects and continuous-improvement efforts that mature TSOC capabilities.\nAs experience increases, provide case review, mentoring, training, process ownership, platform support, project leadership, and technical escalation for less-experienced analysts.\nRequired Qualifications\nCandidates should demonstrate an appropriate combination of education, IT experience, cybersecurity experience, and practical technical capability.\nFoundational understanding of cybersecurity principles and security operations.\nUnderstanding of Windows operating systems and common security-relevant Windows events.\nFamiliarity with Linux operating systems.\nUnderstanding of networking fundamentals including TCP/IP, DNS, HTTP/S, network addressing, and common network protocols.\nFamiliarity with SIEM, EDR/XDR, SOAR, or comparable security technologies.\nUnderstanding of alert triage and cybersecurity investigation methodology.\nFamiliarity with common cybersecurity threats including phishing, credential compromise, malware, suspicious scripting, and attacker persistence techniques.\nFoundational understanding of MITRE ATT&CK and attacker tactics, techniques, and procedures.\nAbility to interpret or develop basic scripts and queries using technologies such as PowerShell, Python, Bash, KQL, or SPL.\nStrong analytical, troubleshooting, and problem-solving skills.\nStrong written and verbal communication skills.\nAbility to clearly document technical investigative findings.\nAbility to appropriately handle confidential and security-sensitive information.\nAbility to learn independently while also knowing when to collaborate or escalate.\nAbility to work effectively in an environment where operational priorities may change rapidly.\nAbility to work independently with appropriate judgment and minimal supervision.\nPreferred Qualifications\nPrevious SOC, cybersecurity operations, incident-response, system administration, networking, IT support, or related technical experience.\nExperience with SIEM / TIP / SOAR / OT Monitoring, or similar security technologies.\nExperience investigating phishing, malware, identity, endpoint, network, cloud, or OT security events.\nExperience with KQL, SPL, PowerShell, Python, or other query/scripting languages.\nFamiliarity with ICS/OT cybersecurity concepts.\nFamiliarity with digital forensics or malware-analysis concepts.\nExperience working with security metrics, dashboards, detection engineering, or automation.\nCertifications such as CompTIA Security+, CySA+, Microsoft SC-200, Splunk Certified Cybersecurity Defense Analyst, or equivalent practical experience.\nSchedule / Operational Requirements\nTSOC provides 24x7 security monitoring, so positions assigned to console operations will include day and night coverage as well as 12-hour shifts. \nAnalysts must be able to respond appropriately to security events originating from multiple monitoring and communication channels.\nAnalysts are expected to maintain situational awareness during assigned operational coverage and follow established shift-handoff and escalation procedures.\nParticipation in incident-response activities or other critical cybersecurity events may occasionally be required outside normal schedules depending upon level and assigned responsibilities.\nBenefits, Compensation & Workforce Diversity\nAt FirstEnergy, employees are key to our success. We depend on their talents to meet the challenges of our changing business environment. We are committed to rewarding individual and team efforts through our total rewards philosophy which includes competitive pay plus incentive compensation, a company-sponsored pension plan, 401(k) savings plan with matching employer contribution, a choice of medical, prescription drug, dental, vision, and life insurance programs, as well as skills development training with tuition reimbursement. Please visit our website at www.firstenergycorp.com to learn more about all of our employee rewards programs. FirstEnergy proudly supports workforce diversity. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status as a protected veteran, or status as a qualified individual with a disability. No recruiters or agencies without a previously signed contract. Unable to sponsor or transfer H-1B visas at this time.\nSafety\nSafety is a core value for FirstEnergy and is essential to all of our business activities. We ensure employees have the tools, information, and processes to perform their duties in a manner that assures safety for themselves, their co-workers, our customers and the public. Our goals are to provide a safe work environment, to maintain an accident-free, injury-free workplace, and to promote and maintain public safety. To meet these goals, we dedicate ourselves to achieving world-class safety standards.\nPosition Classification\nExempt\nFirstEnergy Human Resources Team","description_format":"text","description_chars":8047,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Power Grid","Information Security"],"lifecycle":[{"event":"open","at":"2026-11-13T21:54:44Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":31,"reasons":["conf:3","win:early","comp:brand"],"computed_at":"2026-11-14T01:14:03Z"},"pay":null,"html_url":"https://alion.io/job/firstenergy-cyber-security-operations-analyst-cyber-security-tsoc","json_url":"https://alion.io/job/firstenergy-cyber-security-operations-analyst-cyber-security-tsoc.json","meta":{"generated_at":"2026-11-14T01:14:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":758,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1755196},"rest":"https://alion.io/mcp/rest/get_company?id=1755196"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffirstenergy-cyber-security-operations-analyst-cyber-security-tsoc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffirstenergy-cyber-security-operations-analyst-cyber-security-tsoc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffirstenergy-cyber-security-operations-analyst-cyber-security-tsoc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/firstenergy-cyber-security-operations-analyst-cyber-security-tsoc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffirstenergy-cyber-security-operations-analyst-cyber-security-tsoc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4286156}},{"tool":"search_jobs","arguments":{"company":"firstenergycorp.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4286156},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}