Incident Response Analyst I

Centene Corporation•Remote-MO, MO

18h•$31 - $55

About The Position

The Incident Response Analyst I investigates security incidents, recommends security enhancements, identifies common attack patterns targeting externally facing assets, and helps implement scalable, preventative security measures. The analyst assists with execution of the enterprise Incident Response Plan and supports enterprise-wide remediation coordinated by DFIR, including briefings and reporting for leadership. The role triages and investigates alerts and reported events across endpoint, email, identity, and network telemetry; analyzes phishing and malicious email; documents findings and dispositions; and carries out approved containment actions. It also supports security configuration reviews and access-control validation when needed, identifies opportunities for detection tuning and automation, and contributes to automated scripts and response playbooks. The analyst collaborates with security and technology stakeholders and integrates third-party attack monitoring and threat reporting into internal CIRT communications systems. Applicants must be authorized to work in the United States without current or future employment-based visa sponsorship. Technical skills may be gained through academic, lab, internship, or professional experience. The pay range is $30.58–$55.09 per hour, with actual pay adjusted based on job-related factors. Centene describes its work as supporting access to healthcare and improving the health of individuals, families, and communities.

Requirements

A bachelor's degree in a quantitative or business field, such as statistics, mathematics, engineering, or computer science, and 0–2 years of related experience; equivalent experience or completion of a Centene-sponsored emerging talent program may also qualify.
Authorization to work in the U.S. without the need for current or future employment-based visa sponsorship.
Networking fundamentals, such as TCP/IP, DNS, and HTTP, and knowledge of network and infrastructure technologies, including routers, switches, and firewalls.
Windows and Linux operating-system fundamentals.
Log analysis and investigation of security events.
Knowledge of indicators of compromise (IOCs) and threat actors’ tactics, techniques, and procedures (TTPs).
Beginner-level ability to seek knowledge in the area of specialty.
Beginner-level ability to identify basic problems and procedural irregularities, collect data, establish facts, and draw valid conclusions.

Nice To Haves

Hands-on familiarity with endpoint detection and response (EDR) tools, such as CrowdStrike or Microsoft Defender for Endpoint.
Hands-on familiarity with SIEM platforms and query languages, such as Splunk SPL, KQL, or SQL.
Familiarity with email security platforms, such as Proofpoint, and phishing analysis.
Familiarity with the MITRE ATT&CK framework.
Basic scripting skills, such as PowerShell or Python.
CompTIA Security+, Microsoft SC-200, AWS Certified Cloud Practitioner, or ISC2 CC certification; preferred but not required.

Responsibilities

Investigate security incidents, recommend security enhancements, identify attack patterns targeting externally facing assets, and contribute to scalable preventative security measures.
Assist with execution of the enterprise Incident Response Plan and support remediation coordinated by DFIR.
Triage and investigate security alerts, events, and notifications end to end across endpoint, email, identity, and network telemetry according to alert priorities.
Escalate confirmed or suspected incidents to DFIR according to defined escalation criteria.
Analyze reported and detected phishing and malicious email to determine disposition.
Document investigation steps, findings, and dispositions in the case management system.
Execute approved containment actions, such as IOC blocking and host isolation.
Identify detection-tuning and automation opportunities to reduce manual effort.
Support reviews of security configurations on production information systems and networks when investigation gaps are identified.
Assist with preventing and resolving security breaches and ensure incident and response management processes are initiated.
Assist with access authorization reviews and access-control validation as needed for investigations.
Contribute to automated scripts, response playbooks, and other programmed responses launched when attacks are detected.
Collaborate with Information Security Architects, Information Security Engineers, and software or hardware stakeholders.
Integrate third-party attack monitoring and threat reporting services into internal CIRT communications systems.
Contribute to briefings and reporting for leadership.
Perform other duties as assigned.
Comply with all policies and standards.