Manager, Advanced Cyber Operations

Job Title: Manager, Advanced Cyber Operations

PS Job Title: Manager, Advanced Cyber Operations

Work Place Flexibility: Hybrid 

Legal Entity: Entergy Services, LLC 

***This role may be filled in The Woodlands, TX, Little Rock, AR or New Orleans, LA***

JOB SUMMARY/PURPOSE

The Manager, Advanced Cyber Operations leads the proactive arm of the Consolidated Security Operations Center, directing four service lines: threat hunting operations, cyber threat intelligence operations, offensive operations including red team services, and forensic operations. The role covers Corporate, Cloud, and OT infrastructure and is accountable for finding adversary activity that existing detections miss, understanding the threats most likely to target the utility sector, and testing the organization's defenses against those threats before an adversary does.

Red team and blue team operations run primarily as separate breakout functions, with blue team capabilities residing directly within the CSOC for monitoring and incident response. This position is responsible for coordinating across that boundary, converting hunt findings, intelligence, offensive results, and forensic findings into measurable improvements in detection and response, working with detection engineering, incident response, and system owners across IT and OT. The role reports to the Sr. Manager of the Consolidated Security Operations Center and manages a team of Information Security specialists across the four service lines.

JOB DUTIES/RESPONSIBILITIES

Leadership & Team Management

• Leads the Advanced Cyber Operations team, providing direction, coaching, performance management, and career development for threat hunters, cyber threat intelligence analysts, offensive security analysts, and forensic examiners.
• Recruits, hires, and retains technical staff, and builds the team's skills through structured training, exercises, and rotation across the four service lines.
• Manages the team's O\&M budget, tooling, licensing, and third-party testing engagements, including scoping and quality review of vendor deliverables.
• Establishes and tracks the team's operating metrics, hunt coverage, detection efficacy, intelligence timeliness, mean time to remediate findings, and reports results to the CSOC and cybersecurity leadership.

Threat Hunting Operations

• Owns delivery of threat hunting operations across Corporate, Cloud, and OT environments, including hypothesis development, hunt execution, and conversion of hunt findings into durable detections.
• Maps team activity to MITRE ATT\&CK for Enterprise and ATT\&CK for ICS, and uses coverage gaps to prioritize the hunt, intelligence, and emulation roadmap.
• Partners with detection engineering and incident response to hand off hunt and red team findings and validates that resulting detections and response procedures perform as intended.

Cyber Threat Intelligence Operations

• Directs cyber threat intelligence operations, including collection requirements, adversary tracking, sector-specific reporting, and dissemination of finished intelligence to the CSOC, engineering, and business stakeholders.
• Supports incident response during significant events, providing threat intelligence context, adversary attribution assessments, and targeted hunting for related activity.

Offensive Operations / Red Team

• Directs offensive operations, including penetration testing, adversary emulation, deception capabilities, living off the land (LOTL) techniques and red team engagements, ensuring scope, rules of engagement, and safety controls are approved before execution.
• Delivers red team engagements as a standalone service and coordinate joint exercises with the blue team when an engagement is scoped that way, recognizing that most offensive and defensive work runs as separate breakout functions rather than 100% combined exercises.
• Coordinates offensive activity in OT environments with operations, engineering, and control system owners, applying testing methods appropriate to systems where availability and safety take precedence.

AI & Automation

• Applies AI and agentic AI tooling across all four service lines, automated hunt execution and triage, automated collection and enrichment of threat intelligence, AI-assisted offensive tooling, and automated evidence processing and forensic triage, and sets the standard for where automated output is trusted and where analyst validation is required.
• Builds and maintains automation for red team and blue team exercises, including agentic workflows for adversary emulation, engagement tooling, evidence collection, and reporting.
• Evaluates AI and agentic AI capabilities in existing and prospective cybersecurity tooling and decides where those capabilities add operational value against where they add unverified output.
• Establishes guardrails for agentic AI used by the team, including authorization boundaries, human approval points, and logging sufficient to reconstruct what an agent did during an engagement or hunt.

Digital Forensics & Investigations

• Directs digital forensic operations, including host, memory, network, and cloud forensic examinations, malware triage, and root cause analysis in support of incident response and investigations.
• Establishes and enforces evidence handling standards where applicable, acquisition, chain of custody, preservation, and storage, so forensic work processes and procedures hold up under regulatory examination, legal hold, and litigation.
• Ensures forensic examinations in the OT environment produce the evidence and timeline detail required for NERC CIP-008 incident reporting, using acquisition methods appropriate to systems that cannot be taken offline.
• Partners with IT, Legal, HR, Compliance, and Internal Audit on investigations requiring forensic support, and briefs findings to those stakeholders in terms they can act on.
• Documents team methodology, engagement records, and findings to a standard that withstands internal audit and regulatory examination.

Incident Response

• Participates in incident response for the Consolidated Security Operations Center.

MINIMUM REQUIREMENTS

Minimum Education Required of the Position

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field. An equivalent combination of relevant experience, technical certification, and military or utility operations background will be considered in place of a degree.

Minimum Experience Required of the Position

Seven years of progressive cybersecurity experience, including at least three years in threat hunting, cyber threat intelligence, offensive security, digital forensics, and at least two years leading technical staff as a people manager or technical team lead.

Demonstrated hands-on experience using AI and agentic AI tools in a cybersecurity context is required. This includes applying them to automated threat hunting, automated threat intelligence collection and enrichment, offensive operations, automated evidence processing and forensic triage, and automation supporting red team and blue team exercises, as well as working with AI and agentic AI capabilities built into cybersecurity tooling.

OT literacy is required, the ability to reason about control system architecture, assets, protocols, and operational constraints well enough to scope and govern security work in that environment. A candidate who is strong in threat hunting, cyber threat intelligence, offensive security, forensics and can demonstrate that literacy meets this standard. Two to three years of hands-on experience supporting or securing OT, ICS, or other operational technology environments is preferred, as is experience in a regulated utility, energy, or critical infrastructure environment.

Minimum Knowledge, Skills and Abilities Required of the Position

Technical Knowledge

• Advanced working knowledge of threat hunting methodology, including hypothesis-driven hunting and behavioral analysis across endpoint, network, identity, and cloud telemetry.
• Advanced working knowledge of the intelligence lifecycle, collection management, source evaluation, and analytic tradecraft.
• Advanced working knowledge of offensive security methodology, including penetration testing, adversary emulation, and red team operations, and the safety controls each requires.
• Advanced working knowledge of digital forensic methodology across host, memory, network, and cloud artifacts, including acquisition, analysis, and timeline reconstruction.
• Advanced working knowledge of evidence handling and chain of custody requirements sufficient to support regulatory examination, legal hold, and litigation.
• Strong knowledge of OT and industrial control system architecture, protocols, and the operational constraints that separate OT testing from IT testing.
• Understanding of cloud platform architecture, identity models, and cloud-specific attack paths.
• Understanding of NERC CIP requirements as they apply to security operations, evidence handling, and change control in the OT environment.
• Strong working knowledge of AI and agentic AI capabilities embedded in cybersecurity tooling, including their practical limits and the points at which automated output requires analyst validation.
• Strong working knowledge of applying AI and agentic AI to security operations work, automated hunting, automated intelligence collection and enrichment, AI-assisted offensive tooling, and automation of exercise workflows.
• Strong knowledge of the risks introduced by agentic AI with tool access, including prompt injection, over-broad authorization, and unreviewed action, and the controls that contain them.
• Understanding of the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications (ASI01-ASI10), both published by the OWASP GenAI Security Project, and the ability to apply both to the AI and agentic AI capabilities in use across the environment.

Leadership & Communication

• Ability to lead, develop, and retain technical staff, including performance management and skills development.
• Ability to set priorities across competing service lines and allocate limited specialist capacity against the highest risk.
• Ability to communicate technical findings and risk to executives, engineers, and operations personnel without loss of accuracy.
• Ability to exercise sound judgment during active incidents and under time pressure.
• Ability to operate within defined authorization boundaries and to stop work when scope, safety, or legal conditions are not met.

Any Certificates, Licenses, Etc. Required for the Position

Required

• One senior technical or offensive security certification held at hire or obtained within 12 months of hire (for example OSCP, GPEN, GRTP, GCFA, or GCTI).

Preferred

• For penetration testing, OffSec Certified Professional (OSCP or OSCP+) or GIAC Penetration Tester (GPEN).
• For red team operations and adversary emulation, GIAC Red Team Professional (GRTP).
• GIAC Certified Forensic Analyst (GCFA), GIAC Certified Forensic Examiner (GCFE), or equivalent digital forensics certification.
• GIAC Cyber Threat Intelligence (GCTI).
• Certified Information Systems Security Professional (CISSP).
• An OT or ICS security certification, GIAC Response and Industrial Defense (GRID), or Global Industrial Cyber Security Professional (GICSP).

Desired

• An offensive AI certification, GIAC Offensive AI Analyst (GOAA).

OTHER ATTRIBUTES (If Applicable)

Skills Mastered

The following are expected at hire. The person in this role should be able to perform each of these without ramp-up or oversight.

• Plans and runs a threat hunt end to end, frames the hypothesis, selects the data, executes the hunt, and closes it out with a detection or a documented negative result.
• Produces and defends finished intelligence assessments, including confidence levels and the reasoning behind an attribution judgment.
• Scopes and authorizes offensive engagements independently, including rules of engagement, deconfliction, and stop conditions.
• Reads and interprets adversary tradecraft from raw telemetry, logs, packet data, memory, and endpoint artifacts, without relying on tooling to interpret it.
• Maps adversary behavior to MITRE ATT\&CK for Enterprise and ICS and translates that mapping into detection and testing priorities.
• Assesses the operational risk of a security test in an OT environment and adjusts method or scope accordingly.
• Applies AI and agentic AI tooling to hunting, intelligence, offensive, and forensic work, and judges accurately where automated output can be acted on and where it must be validated first.
• Designs and maintains automation for repeatable operations, hunt triage, intelligence enrichment, adversary emulation, exercise workflows, without losing traceability of what the automation did and why.
• Conducts and reviews a forensic examination end to end, acquires evidence defensibly, reconstructs the timeline, and states findings with the limits of the evidence made clear.
• Maintains chain of custody and documentation to a standard that survives legal and regulatory challenge.
• Manages a technical team through direction setting, feedback, and difficult performance conversations.
• Briefs executives and operations leadership on adversary risk, translating technical findings into decisions those audiences can act on.
• Writes clearly and concisely under deadline, engagement reports, intelligence products, and incident documentation that hold up to audit.
• Maintains composure and clear decision-making during active incidents and escalations.

Technical Competencies

• Advanced Threat Hunting - Designs the hunt program, not just individual hunts, decides which hypotheses are worth analyst time, what telemetry is needed to test them, and when a negative result is conclusive rather than inconclusive. Recognizes when a hunt has been invalidated by a data gap and says so instead of reporting a clean result.
• Advanced in Cyber Threat Intelligence - Sets analytic standards for the team: how confidence is expressed, what evidence supports an attribution judgment, and when a claim from a vendor or peer report should not be repeated. Tracks the actor sets that matter to the utility sector rather than consuming general intelligence.
• Advanced Knowledge of Offensive Operations & Adversary Emulation - Builds threat-informed emulation plans from intelligence rather than running generic test cases. Judges where an operation stops adding value and becomes risk and can reconstruct exactly what an engagement did and when.
• Advanced Knowledge of AI and Agentic AI in Security Operations - Applies AI and agentic AI across hunting, intelligence, offensive, and forensic work, and judges accurately where automated output can be acted on and where it must be validated. Understands the risks that tool access introduces, prompt injection, over-broad authorization, unreviewed action, and the controls that contain them.
• Advanced Knowledge of OT & ICS - Reasons about control system architecture, assets, protocols, and operational constraints well enough to scope and govern security work in that environment. Knows why standard IT methods, scanning, agent deployment, forced reboots, credential rotation, fail or cause harm on control equipment, and what to do instead.

Process Competencies

• Advanced in Engagement Authorization – Owning the process by which offensive work is scoped, approved, deconflicted, and stopped. Defines stop conditions before execution and enforce them during, including halting an engagement that is technically succeeding.
• Advanced in Intelligence Lifecycle Management – Runs requirements, collection, production, dissemination, and feedback as a managed cycle, so intelligence reaches the people who can act on it in a form they can act on.
• Advanced in Detection Handoff and Validation - Owns the loop that converts a hunt, engagement, or forensic finding into a detection or response change, and confirms the result performs as intended rather than assuming the handoff closed the gap.
• Advanced in OT Change and Safety Coordination - Runs the coordination process with operations, engineering, and control system owners before any testing touches the OT environment and adjusts method or scope when availability or safety requires it.

Capabilities (Master)

• Stakeholder Engagement
• Problem Solving
• Communication
• Innovation
• Customer Centricity
• Strategic Thinking
• Continuous Improvement

WORKING CONDITIONS

This position requires hybrid/on-site presence and participates in incident response for the Consolidated Security Operations Center, including nights, weekends, and holidays as assigned.

Travel: 25% annually.

As a provider of essential services, Entergy expects its employees to be available to work additional hours, to work in alternate locations, and/or to perform additional duties in connection with storms, outages, emergencies, or other situations as deemed necessary by the company. Exempt employees may not be paid overtime associated with such duties.

 #LI-DG1 #LI-HYBRID 

Primary Location: Texas-The Woodlands Texas : The Woodlands || Arkansas : Little Rock || Louisiana : New Orleans 
Job Function: Corporate
FLSA Status: Professional 
Relocation Option:
Union description/code: NON BARGAINING UNIT 
Number of Openings: 1
Req ID: 125557
PS Job Title: Manager, Advanced Cyber Operations 
Travel Percentage:Up to 25%

An Equal Opportunity Employer, Minority/Female/Disability/Vets. Please click here to view the EEO page, or see statements below.

EEO Statement: The Entergy System of Companies provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, gender, sexual orientation, gender identity or expression, national origin, age, disability, genetic information, marital status, amnesty, or status as a protected veteran in accordance with applicable federal, state and local laws. The Entergy System of Companies complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment including, but not limited to, recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training. 

The Entergy System of Companies expressly prohibits any form of unlawful employee harassment based on race, color, religion, sex, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status. Improper interference with the ability of the Entergy System of Company employees to perform their expected job duties is absolutely not tolerated.

Accessibility: Entergy provides reasonable accommodations for online applicants. Requests for a reasonable accommodation may be made orally or in writing by an applicant, employee, or third party on his or her behalf. If you are an individual with a disability and you are in need of an accommodation for the recruiting process please click here and provide your name, contact number, the accommodation requested and the requisition number that you are requesting the accommodation for. Employee Services will contact you regarding your request.

Additional Responsibilities: As a provider of essential services, Entergy expects its employees to be available to work additional hours, to work in alternate locations, and/or to perform additional duties in connection with storms, outages, emergencies, or other situations as deemed necessary by the company. Exempt employees may not be paid overtime associated with such duties.

Know Your Rights: Workplace Discrimination is Illegal

The non-confidential portions of the affirmative action program for individuals with disabilities and protected veterans shall be available for inspection upon request by any employee or applicant for employment.  Please contact [email protected] to schedule a time to review the affirmative action plan during regular office hours.

WORKING CONDITIONS:
As a provider of essential services, Entergy expects its employees to be available to work additional hours, to work in alternate locations, and/or to perform additional duties in connection with storms, outages, emergencies, or other situations as deemed necessary by the company. Exempt employees may not be paid overtime associated with such duties.

Please note: Authorization to work in the United States is a precondition to employment in this position. Entergy will not sponsor candidates for work visas for this position.