Incident Response Analyst

Ardent Health • Brentwood, TN

2d

About The Position

The Information Security Analyst – Incident Response responds to cyber-attacks, network intrusions, and computer crimes. Incident response analyst contributes to all aspects of the incident response from initiation to conclusion. Additionally, the IR analyst performs all activities occurring during the incident following policy, procedures, and established methodologies. Participates in root cause analysis for each event and helps to define follow-up action items including recommendations. A successful candidate in this role strives to enforce Information security best practices, policies, standards, and guidance to ensure the safeguard of proprietary data, physical infrastructure and resources from internal and external threats.

Requirements

• Associates degree or equivalent cybersecurity training/experience.
• Knowledge of: Windows/Linux forensics, regular expressions, Powershell, Bash, Javascript, Python, SQL, Active Directory, networking protocols/flow, authentication and authorization protocols
• Familiarity of: cyber kill chain, MITRE ATT&CK/D3FEND, NIST SP 800-61, NIST SP 800-53 ISO 27001.
• Previous security platform experience (SIEM, EDR, email security gateway, etc.)
• Knowledge of common and emerging attack vectors, penetration methods, countermeasures, and remediation methods.
• Prioritize tasks effectively to meet project deadlines and deliverables.
• Passion for cybersecurity, problem solving and learning.
• Excellent written and oral communication skills
• Experienced in assessing and/or administering intrusion detection/prevention.
• ITIL familiarization or experience - managing incidents, requests, and changes.
• Solving complex problems with information technology.
• Ability to handle stressful situations.
• Ability to collaborate with IT and business departments to identify, contain, eradicate, and recover.
• Ability to balance the seriousness of protecting electronic information assets with the need to enable users to effectively and efficiently use systems to perform job responsibilities, while continuing to emphasize quality patient care.
• Strong customer service focus and ability to manage client (e.g., facility) expectations.
• Excellent oral and written communication skills with the ability to present and discuss technical information in a manner suitable for the audience.
• Must be willing to travel occasionally.
• Must be willing to respond to security issues 24x7 (on call).

Nice To Haves

• SOC, IR, threat hunt or sysadmin training/experience.
• CTF and/or training tools (HTB) participation.
• DoD 8570 IAT II or higher compliant certifications or reputable security certifications. Examples include: GCIH, GCIA, CEH, GSEC, GCFA, GCFE, Sec+, CySA+, CCNA Sec, CCNA Cyber, blue team certifications, Microsoft certifications and other equivalents.

Responsibilities

• Monitors and acts on security incidents.
• Follows incident response processes, procedures, and playbooks.
• Participates in tabletop exercises / training.
• Contributes to incident reports and maintain incident logs.
• Builds /Maintains an incident response toolkit.
• Research and recommend solutions that meet security standards while ensuring functionality for business continuity.
• Assists in development of disaster recovery and contingency plans.
• Works closely with Threat and Vulnerability team using purple team process, procedures and exercises.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Associate degree