Description

Be a part of something powerful at America's premier energy provider!

At Exelon, we are united by our values and shared vision for a cleaner and brighter future. We encourage curiosity, value diverse perspectives and we never stop looking for ways to be, work and do better. We know the future is in our hands. That's why we're looking for people like you, who have the power to make a difference.

As the nation's largest utility company, we serve more than 10 million customers through six fully regulated transmission and distribution utilities: Atlantic City Electric (ACE), Baltimore Gas and Electric (BGE), Commonwealth Edison (ComEd), Delmarva Power & Light (DPL), PECO Energy Company (PECO), and Potomac Electric Power Company (Pepco). All 18,000 of us are committed to delivering safe, reliable and affordable energy to our customers, strengthening our communities, supporting a clean energy future and reducing our impact on the changing climate.

Our people are the heart and soul of our business. Whether it's powering lives, supporting communities or collaborating with colleagues, an Exelon employee is talented, compassionate, forward-thinking and inspired. We are empowered to evolve and advance our careers in an open and inclusive environment. We pride ourselves on being the kind of place where people want to come and stay. We know that investing in our employees' futures strengthens ours, which is why we offer competitive compensation, incentives and health and retirement benefits.

PRIMARY PURPOSE OF POSITION

The Insider Threat Analyst is a member of the Insider Threat Team with primary responsibility for mitigating, identifying, and responding to insider threat security events. The Insider Threat team is responsible for preventing, detecting, and responding to data exfiltration, workplace violence, systems sabotage, misuse of corporate assets, and other threats.

Conduct complex and technical data analysis; support development and tuning of rules, policies, and alerts for DLP and UEBA applications; support development of strategies to deter, detect, and respond to insider threats; and collaborate with security operation centers, digital forensics, and physical security teams.

PRIMARY DUTIES AND ACCOUNTABILITIES

• Identify and Respond to Insider Threat Security Events

  • Respond, analyze, and triage alerts from DLP, UEBA and other monitoring tools

  • Coordinate with enterprise-wide cyber defense staff to validate alerts

  • Analyze security incidents for trends and patterns to uncover anomalies, identify gaps, and propose risk mitigation solutions (80%)

• Develop Insider Threat Use Cases and Tune DLP and UEBA rules and policies

  • Support the development of distinct insider threat use cases; identify tools, policies, and rules to monitor for the use case; tune policies and rules to meet use case requirements

  • Based on analysis of alerts, modify rules and policies to increase accuracy and reduce false positives

  • Identify and propose new data sources to identify insider threat activity (15%)

• Support security reviews, cyber defense trend analysis and open-source research. 

  • Identify vulnerabilities in security architecture or controls; and recommended changes to resolve or mitigate risk of these vulnerabilities

  • Analyze insider events to identify patterns and develop mitigation strategies

  • Conduct open-source research about industry trends and developments in protecting company assets and countering Insider Threats (5%)

JOB SCOPE

Develop and implement innovative solutions to improve the detection, correlation, and analysis of insider risk indicators to protect Exelon’s physical assets, electronic assets and personnel. Responsible for enhancing existing technical capabilities to identify and mitigate technical pathways for data exfiltrating and the potential sabotage of Exelon’s assets.

DISCLAIMER

The preceding position description is intended to provide the general nature and level of work to be performed by employees within this classification.  It is not intended to be a detailed description of the position or a comprehensive listing of all duties, responsibilities, and qualifications required of employees assigned to this position, nor is it intended to indicate the exact amounts of time an individual will perform various position duties.

Qualifications

MINIMUM QUALIFICATIONS

• Bachelor’s Degree in Computer Science, Cybersecurity, or related 4-year technical degree with 2 to 3 years of experience in IT or cybersecurity, or equivalent combination of education and work experience
• Skill in collecting data from a variety of cyber defense resources and ability to interpret information collected to recognize threat
• Knowledge of DLP, UEBA, and logging applications; and skill tuning policies within these tools
• Knowledge of incident response and handling methodologies.
• Knowledge of computer networking concepts and protocols, and network security methodologies.
• Knowledge of host/network access control mechanisms
• Knowledge of operating systems
• Knowledge of scripting languages
• Knowledge of cyber-attack stages and techniques used by malicious insiders
• Skill in conducting trend analysis

PREFERRED QUALIFICATIONS

• Insider threat analysis experience
• Knowledge of Insider Threat investigations, reporting, investigative tools and laws/regulations
• Knowledge of NIST SP 800-53 Cybersecurity Framework
• Prior experience at an electrical utility and with NERC CIP compliance