Cyber Threat Analyst

Premier Inc.

1d•$72,000 - $120,000•Remote

About The Position

The Cyber Threat Analyst is responsible for monitoring and responding to security events, conducting detailed analyses of security incidents, and assisting in the development of security policies. This role serves as an intermediate step between a Security Operations Analyst and an Associate Information Security Engineer, handling more complex security incidents and providing mentorship to junior analysts. A more advanced role, but like the Security Operations Analyst, the Cyber Threat Analyst is responsible for activities relating to monitoring and responding to security events. The Cyber Threat Analyst receives, researches, triages and documents all security events and alerts as they are received. This individual supports multiple security-related platforms and technologies, interfacing with others within the IT organization, as well as other internal business units and external customers/partners. Events will be generated from endpoints, networks, security information and event management (SIEM) systems, threat intelligence platforms, employees, third parties and other sources. The Cyber Threat Analyst also receives information sharing and analysis center (ISAC) information and is expected to hunt for potential compromise across the infrastructure. The Cyber Threat Analyst reports to the Senior Manager Support Services and is an involved member of the SOC team. This role must display an in-depth understanding of current trends and technologies related to IT security and compliance and contribute to the company IT security strategy and roadmap. This role is part of a 24X7 on-call rotation which has strict SLA response commitments.

Requirements

Years of Applicable Experience - 2 or more years
High School Diploma or GED (Required)
Required participation in 24X7 on-call rotation and availability to assist with issues that arise outside of business hours.
Remain in a stationary position for prolonged periods of time
Be adaptive and change priorities quickly; meet deadlines
Attention to detail
Operate computer programs and software
Ability to communicate effectively with audiences in person and in electronic formats.
Day-to-day contact with others (co-workers and/or the public)
Making independent decisions
Ability to work in a collaborative business environment in close quarters with peers and varying interruptions

Nice To Haves

Experience working with SIEM systems, threat intelligence platforms, security automation and orchestration solutions, intrusion detection and prevention systems (IDS/IPS), file integrity monitoring (FIM), DLP and other network and system monitoring tool
Working knowledge/experience with network systems, security principles, applications and risk and compliance initiatives such as Payment Card Industry (PCI), Health Information Portability and Accountability Ace (HIPAA), Sarbanes-Oxley Act (SOX) and the General Data Protection Regulation (GDPR)
Experience with the following skills: network defense, ethical hacking, incident response, computer forensics, and reverse engineering
Track record of acting with integrity, taking pride in work, seeking to excel, being curious and adaptable, and communicating effectively
3-5 years of information security monitoring and response or related experience desired
Experience with user and entity behavior analytics (UEBA) and security orchestration and automation (SOAR) desired
Bachelor’s Degree; SANS GCIH or GCIA; Security+, Network+, CISSP a plus

Responsibilities

Monitoring and Responding to Security Events Monitor security events from various sources, including endpoints, networks, SIEM systems, and threat intelligence platforms. Respond to these events promptly and effectively.
Incident Analysis and Investigation Conduct detailed analyses of security incidents to understand the nature and impact of the threat. Identify the source and destination IP addresses, assess the impact of the attack, and investigate the attack using internal and external tools.
Documentation and Reporting Document all security events and incidents thoroughly. Create incident timelines, record evidence, and prepare detailed reports on findings.
Recommend enhancements, implement, and manage security tools Provide feedback around current monitoring and alerting to improve detection and alerting. Enhance analysis through automation. Participate in the administration and/or review of access reviews, firewall rule reviews, quarterly web application firewall reviews, and web proxy policy exceptions.
Reduce downtime and ensure business continuity Proactively notifying the appropriate stakeholders about serious security events.
Mentorship and Training Provide guidance and support to junior analysts, helping them develop their skills and knowledge.
Proactive Security Measures Involved in proactive security measures, such as threat hunting and vulnerability assessments, to identify and mitigate potential threats before they can cause harm.