{"id":3309960,"url":"https://alion.io/job/iberdrola-lead-cyber-detect-response-specialist","title":"Lead Cyber Detect & Response Specialist","company":{"id":5398,"name":"Iberdrola","domain":"iberdrola.com","url":"https://alion.io/company/iberdrola","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":94,"open_postings":37,"ghost_share":0.027,"stale_share":0.324,"repost_share":0.054,"time_to_fill_p50_days":15,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Rochester, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":116640,"max":145800,"currency":"USD","period":"year","gross":null,"usd_annual":145800},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"SIEM","optional":false},{"name":"Zero Trust","optional":false},{"name":"NERC CIP","optional":true}],"status":"live","first_seen_at":"2026-10-26T00:00:00Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-28T00:25:10Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Position Information\nJob Title: Lead Cyber Detect & Response Specialist\nLocations: Rochester, NY or Binghamton, NY\nSalary Range: $116,640 - $145,800\nSchedule: On Site, 5 days\nDescription\nThe Lead Cybersecurity Specialist, Cyber Detection & Response is responsible for the detection and response to security incidents and threats within Avangrid’s Operation Smart Grid (OSG) and other Business Units including Control Systems and Automation, OSG Telecommunications, OSG Infrastructure, OSG AMI, Distributed Automation, Process & Technology, Innovation, Corporate Security, Corporate Risk, Legal, Insurance, Audit, Investment Planning, and Regulatory. This role requires the ability to fully engage in all phases of the incident lifecycle, provide leadership and mentorship of indirect reports, understanding threats and providing oversight mitigations.\nResponsibilities\nLead the development and deployment of security services and solutions in support of Avangrid’s evolution towards a zero-trust security framework.\nAssist in establishing a security incident detection and response program for OSG that is well defined, highly available, repeatable, and is constantly measured for Key performance, Key risk, and Key operational level metrics.\nIdentify, respond, and mitigate threats to Avangrid and its affiliated entities.\nConduct incident response activities, including advanced investigation (forensic, malware analyses, root cause analysis etc.) to investigate potential intrusions and develop remediation guidance.\nPerform the activities necessary for the immediate, short-term rapid resolution of incidents to minimize risk exposure and production down-time.\nMaintain a professional communicative relationship with clients and management to provide information throughout the incident, problem, and change management cycles.\nCoordinate and drive efforts among multiple IT and OT business units during response activities and post-mortem.\nProactive monitoring of internal and external-facing environment using specialized security applications.\nProvide timely, comprehensive, and accurate information to OSG leadership in both written and verbal communication.\nProactively research and monitor security-related information sources to aid in the identification of threats to Avangrid networks, systems and Avangrid control systems.\nMentor and develop other staff members on incident response, analysis, and tools.\nRoutinely develop and update incident response playbooks to ensure response activities align with best practices, minimize gaps in response and provide comprehensive mitigation of threats.\nParticipate and develop security incident and penetration testing procedures including penetration testing criteria, performance of testing, and implementation of lessons learned.\n\nSkills and Requirements\nEducation & Experience Required\nMaster’s Degree in Engineering, Computer Science, or technical related degree with a minimum of 6+ years’ experience in Cybersecurity.\nBachelor’s Degree in Engineering, Computer Science, or technical related degree with a minimum of 8+ years’ experience in Cybersecurity.\nAssociate Degree in Engineering, Computer Science, or technical related degree with a minimum of 10+ years’ experience in Cybersecurity. 3+ years of Information Security experience.\nHands-on troubleshooting, analysis, and technical expertise to resolve incidents and service requests; previous experience in troubleshooting day-to-day operational processes such as security monitoring, data correlation, security operations, etc.\nProven experience performing analysis of security events and incidents, to determine root cause and provide resolution.\nStrong working knowledge of at least three of the following security tools: host-based antivirus, anti-spam gateway solutions, firewalls, IDS/IPS, server and network device hardening, data loss prevention, forensics software, vulnerability management, website security.\nCompetence in using both internal and external ticketing systems for incident, problem & change management.\nExcellent oral and written communication skill.\nExperience working with Cyber Threat Intelligence, Threat Defense and Hunting teams.\nCustomer oriented leader capable of communicating to technical and business unit stakeholders.\nExperience with Access Controls systems and solutions (SSO, AD, TACACS, MFA, cloud based).\nExperience with a variety of information and network security infrastructure and tools (SIEM, IDS/IPS, firewall, WAF, configuration management).\nExperience with key security process and procedures (system hardening, patch management, vulnerability management, log management, access controls, supplier management, information classification/handling).\nExperience with common security operations services (access management, electronic perimeter management, baseline management, vulnerability assessments).\nSkills/Abilities: \nA team-focused mentality with the proven ability to work effectively with diverse stakeholders.\nProactive attitude, seeking for improvement opportunities which can positively impact the security posture and the business.\nAn ability to work extremely well under pressure while maintaining a professional image and approach.\nDecision-making capabilities, with an ability to weigh the relative costs and benefits of potential actions and identify the most appropriate one.\nDesired Skills/ Abilities: \nRelevant technical security certifications (CISM, CEH, Security+, CISSP, GSOC etc.)\nSecurity architecture/management certifications (ISO27000, ISACA, etc.).\nKnowledge of Federal Government cybersecurity activities and practices.\nExperience in Federal or State regulatory environments.\nExperience in Federal cybersecurity agencies and environments.\nExperience in a utility environment.\nExperience working with international teams.\nSecurity clearance.\nThreat Intelligence or Forensic background is a plus.\nCompetencies\n· Be a role model\n· Be agile\n· Collaborate and Share\n· Develop Self & Others\n· Empower to grow\n· Focus to achieve results\n· Technical Skills\nWhat We Offer:\nCompetitive benefits and growth opportunities\nGenerous performance-based bonuses\n 12% 401(k) match\nComprehensive health, dental, and vision insurance\nTuition reimbursement\nProfessional development and clear career-advancement pathways\nFor more information, please visit:Benefits - Avangrid\n#LI-Onsite; #LI-CH1\nCompany:\nROCHESTER GAS & ELEC CORPMobility Information\nPlease note that any applicant who is not a citizen of the country of the vacancy will be subject to compliance with the applicable immigration requirements to legally work in that country.\nAt Avangrid we provide fair and equal employment and advancement opportunities for all employees and candidates regardless of race, color, religion, national origin, gender, sexual orientation, age, marital status, disability, protected veteran status or any other status protected by federal, state, or local law.\nIf you are an individual with a disability or a disabled veteran who is unable to use our online tool to search for or to apply for jobs, you may request a reasonable accommodation by contacting our People and Organization department at .\nAvangrid employees may be assigned a system emergency role and in the event of a system emergency, may be required to work outside of their regular schedule/job duties. This is applicable to employees that will work in Connecticut, Maine, Massachusetts, and New York within Avangrid Network and Corporate functions. This does not include those that will work for Avangrid Power.\nAvangrid employees may also be assigned a NERC Reliability Standards compliance role supporting Critical Infrastructure Protection (CIP) and/or Operations and Planning (O&P) responsibilities. This is applicable to employees that will work in electric transmission, operations, and cyber security business areas in Connecticut, Maine, Massachusetts, and New York within Avangrid Network and Corporate business areas. NERC Reliability Standards compliance roles and responsibilities may include additional access protections, training, audit engagement, and required evidence retention, and will be communicated by the employee’s management.\nJob Posting End Date:\nNovember-26-2026","description_format":"text","description_chars":8245,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"associate","optional":false},"security_clearance":false,"languages":[]},"benefits":["Growth opportunities","Professional development","Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Energy Storage","Power Grid","Information Security","Wind Energy"],"lifecycle":[{"event":"open","at":"2026-10-27T02:57:30Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":15,"reasons":["conf:5","velocity","win:early","comp:brand"],"computed_at":"2026-10-28T05:59:10Z"},"pay":{"stated_usd_annual":145800,"is_top_pay":false},"html_url":"https://alion.io/job/iberdrola-lead-cyber-detect-response-specialist","json_url":"https://alion.io/job/iberdrola-lead-cyber-detect-response-specialist.json","meta":{"generated_at":"2026-10-28T10:29:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13784,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5398},"rest":"https://alion.io/mcp/rest/get_company?id=5398"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fiberdrola-lead-cyber-detect-response-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fiberdrola-lead-cyber-detect-response-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fiberdrola-lead-cyber-detect-response-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/iberdrola-lead-cyber-detect-response-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fiberdrola-lead-cyber-detect-response-specialist"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3309960}},{"tool":"search_jobs","arguments":{"company":"iberdrola.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3309960},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}