{"id":2358593,"url":"https://alion.io/job/southern-ems-security-analyst-2","title":"EMS Security Analyst","company":{"id":2607898,"name":"Southern","domain":"southern.com","url":"https://alion.io/company/southern-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Birmingham, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":97000,"max_usd":189000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1121},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Perl","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false}],"status":"live","first_seen_at":"2026-10-12T13:20:14Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-13T02:57:04Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"EMS Security Analyst - INSM (Energy Management Systems)\nLocation: This is an in-office position in Birmingham, AL.\nSummary of Position Duties\nThe successful candidate will serve as a key contributor to network security monitoring functions supporting critical Energy Management System (EMS) and operational technology (OT) environments. Responsibilities include deploying, administering, and optimizing network security monitoring capabilities; maintaining asset and communication visibility; analyzing enterprise and SCADA system network activity; supporting threat detection and incident investigation; and meeting cybersecurity and compliance requirements within a highly regulated NERC CIP environment.\nEducation and Experience\nDegree in computer science, cybersecurity, information systems, electrical engineering, or equivalent experience.\n\nIndustry certification preferred (CISSP, CISA, CISM, GICSP, or equivalent experience).\n\nMinimum of five (5) years of cybersecurity experience. Hands-on experience in OT cybersecurity, network security monitoring, traffic analysis, or related security functions is preferred.\nMajor Responsibilities\nAdminister and support network security monitoring platforms, sensors, management systems, and supporting infrastructure across EMS/SCADA and OT environments.\n\nDesign, configure, and maintain network visibility architecture, including traffic aggregation, packet brokering, network taps, span monitoring, sensor placement, and secure data flows.\n\nMonitor and analyze network communications to identify assets, protocols, dependencies, anomalous activity, unauthorized changes, misconfigurations, and potential cyber threats.\n\nDevelop and tune detections, alerts, baselines, policies, and asset classifications to improve monitoring accuracy, reduce false positives, and prioritize operationally significant risk.\n\nSupport packet capture, metadata collection, log forwarding, and integrations with enterprise security monitoring, incident response, vulnerability management, and reporting capabilities.\n\nPartner with EMS, network, infrastructure, application, and cybersecurity subject matter experts to validate network behavior, strengthen segmentation, reduce unnecessary communications, and improve the security posture of critical systems.\n\nInvestigate, troubleshoot, and resolve security monitoring and network visibility issues while minimizing operational impact to EMS and SCADA environments.\n\nPerform threat hunting, event triage, and incident investigation using network telemetry, packet-level evidence, asset context, and other available security data.\n\nEvaluate emerging OT security and network visibility technologies and provide recommendations that support EMS cybersecurity strategy, architecture, operational, and compliance objectives.\n\nSupport compliance initiatives and audits related to NERC CIP, FERC, SERC, Sarbanes-Oxley, and other applicable regulatory requirements by maintaining monitoring evidence, documentation, procedures, and technical controls.\n\nDevelop and maintain automation, reporting, health monitoring, and operational efficiencies through scripting and tools utilizing Python, PowerShell, Perl, or shell scripting.\n\nKnowledge, Skills, and Abilities\nExperience with OT security monitoring, network visibility, packet capture, traffic analysis, or similar platforms such as Dragos, Nozomi, Claroty, Riverbed, or comparable tools.\nUnderstanding of cybersecurity principles, EMS/SCADA operations, network architecture, common network protocols, and business objectives required to support secure and reliable operations.\nStrong analytical, critical-thinking, problem-solving, and troubleshooting skills, with the ability to distinguish expected operational behavior from potentially malicious or unauthorized activity.\n\nAbility to manage multiple priorities and adapt to changing operational requirements while protecting the availability and reliability of critical systems.\n\nStrong organizational skills with the ability to quickly learn, evaluate, document, and apply new technologies and monitoring methods.\n\nExcellent verbal and written communication skills with the ability to communicate technical findings, operational risk, and recommended actions to technical and non-technical audiences.\n\nBehavioral Attributes\nDemonstrate behaviors consistent with Southern Company's Values and commitment to customer service.\nBe proactive, self-motivated, and accountable, with a strong sense of ownership and follow-through.\nBuild and maintain effective working relationships with team members, customers, and stakeholders across the organization.\nExhibit initiative, adaptability, and a collaborative approach to achieving team and organizational objectives.\n\nThis position falls under the company’s Insider Threat Program and will have access to, and control over sensitive data, systems or assets. Enhanced personnel screening, which includes a background review, drug screen, and psychological assessment, will be required if you are selected for this position.","description_format":"text","description_chars":5044,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Contract Manufacturing","Energy & Utilities","Power Grid","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-12T15:22:16Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":14,"reasons":["conf:0","win:early"],"computed_at":"2026-10-13T03:17:37Z"},"pay":null,"html_url":"https://alion.io/job/southern-ems-security-analyst-2","json_url":"https://alion.io/job/southern-ems-security-analyst-2.json","meta":{"generated_at":"2026-10-13T03:17:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5033,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2607898},"rest":"https://alion.io/mcp/rest/get_company?id=2607898"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsouthern-ems-security-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsouthern-ems-security-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsouthern-ems-security-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/southern-ems-security-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsouthern-ems-security-analyst-2"}]}