Cyber Security Analyst

• Cyber Security Firewall Analyst
• Charlotte, NC

We are one of the largest electric power holding companies in the United States, providing electricity to 7.7 million retail customers in six states. We have approximately 51,000 megawatts of electric generating capacity in the Carolinas, the Midwest and Florida – and natural gas distribution services serving more than 1.6 million customers in Ohio, Kentucky, Tennessee and the Carolinas.

The Cybersecurity Systems Engineering Analyst will be a key contributor accountable for supporting the Secure Access Service Edge environment and legacy Inspection Zone tools including (Palo Alto Prisma Access, Big IP F5, and Proxy). The position will interface with cross-functional teams from Cybersecurity, IT, and critical business operations to ensure the confidentiality, integrity, availability, and regulatory compliance of Duke Energy’s computing environments. The Analyst will work closely with peers, other internal/external teams, and management in a 24x7 Cybersecurity Operations Center (CSOC) environment. The Cybersecurity Systems Engineering Analyst is expected to build positive and collaborative relationships with stakeholders across the company, identify ways to improve working relationships across organizational boundaries through collaborative planning and communicate clearly, candidly, and openly. The Analyst is also responsible for following processes and procedures as defined by Cybersecurity leadership and the Cyber Incident Response Team (CIRT).

Key responsibilities to include:

• Participate in the implementation, support, and lifecycle management of Palo Alto Networks Secure Access Service Edge (SASE) solutions (Prisma Access, Global Protect, Strata Cloud Manager) within a large-scale enterprise environment, while maintaining integration with Inspection Zone technologies (F5 BIG-IP, SWG/Proxy, etc.)
• Design, deploy, and continuously optimize cloud-delivered security controls including secure web gateway (SWG), CASB, ZTNA, and threat prevention capabilities aligned to Palo Alto SASE architecture
• Provide advanced engineering support for SASE and Inspection Zone security platforms, partnering closely with Security Operations, Network Engineering, and Incident Response teams
• Drive security monitoring, telemetry integration, and policy enforcement across SASE and on-prem inspection environments to ensure consistent visibility and threat detection
• Perform system hardening, high availability design, and resilience engineering for SASE and Inspection Zone environments, including failover strategy and service continuity planning
• Maintain a strong understanding of the global threat landscape and apply Palo Alto threat intelligence and best practices to proactively reduce enterprise risk exposure
• Drive continuous improvement of detection and response capabilities, leveraging SASE telemetry to enhance incident analysis, threat hunting, and mitigation effectiveness
• Develop and report on operational and security metrics (e.g., policy effectiveness, threat prevention performance, user activity visibility) to inform leadership decision-making and improve operational maturity
• Collaborate with cross-functional teams and leadership to align SASE strategy with enterprise security architecture, modernization initiatives (e.g., legacy proxy replacement), and business objectives

Desired Qualifications:

• Hands-on experience with Palo Alto Networks SASE (Prisma Access) including Mobile Users, Remote Networks, and Service Connections
• Strong understanding of Security Service Edge (SSE) capabilities (SWG, CASB, ZTNA, DNS Security, SaaS security)
• Expertise in policy design, traffic steering, and segmentation within cloud-delivered security platforms
• Strong knowledge of network protocols (BGP, IPSec, routing, NAT) and SASE connectivity design
• Experience integrating SASE with on-prem Inspection Zone and hybrid cloud architecture
• Proficiency with Global Protect and remote access/VPN solutions
• Experience with automation and scalability (APIs, scripting, infrastructure-as-code such as Python or Terraform)
• Strong background in high availability design, system hardening, and performance optimization
• Experience leading or supporting migration from legacy proxy/multi-vendor environments to SASE platforms
• Strong understanding of cybersecurity frameworks and best practices (NIST, CIS, Zero Trust)
• Proven ability to collaborate cross-functionally, communicate risk effectively, and provide leadership-ready updates
• Possession of multiple industry standard certifications such as SANS GIAC/GCIA/GCIH/GCFA, CISSP, CISA, CISM, etc. or other network / system security certifications.