Sec Ops Analyst II

Noridian Healthcare Solutions, LLC•Fargo, ND

1d•Remote

About The Position

Security Operations Analysts are responsible for monitoring, detecting, and responding to cybersecurity threats and incidents across the enterprise. They perform threat analysis, incident response, and proactive threat hunting while ensuring compliance with Centers for Medicare & Medicaid Services (CMS) Acceptable Risk Safeguards (ARS) 5.1, National Institute of Standards and Technology (NIST) 800-53, and Federal Information Systems Management Act (FISMA) standards. The team works to continuously improve security processes, tools, and automation, with a focus on advanced monitoring, containment and remediation activities.

Requirements

Bachelors degree in Information Technology, Cybersecurity, or related field OR equivalent work experience determined by Human Resources.
3 years of experience in security operations, threat detection, or incident response.
Hands-on experience with EDR, SIEM, Intrusion Detection System/Intrusion Prevention System, and SOAR platforms.
Understanding of incident lifecycle (detect, analyze, contain, eradicate, recover) and NIST 800-53
Proficiency in interrupting network packets, logs, and endpoint telemetry.
Working knowledge of MITRE ATT&CK and its application to detection logic, automation, and threat modeling.
Strong attention to detail, communication, and documentation skills.
Strong analytical and critical-thinking skills with ability to prioritize under pressure.

Nice To Haves

CompTIA Security+, CySA+, or equivalent entry-level certification
4 years experience in security operations, threat detection, or incident response.

Responsibilities

Performs initial triage and investigation of alerts generated by System Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Data Loss Prevention (DLP), and other monitoring tools using critical thinking, problem-solving, and the MITRE ATT&CK framework.
Monitors network, host, and application alerts for indicators of compromise or policy violations.
Vulnerability intake and classification. Manages the intake and classification of security vulnerabilities.
Researches and classifies software patch updates.
Creates and updates incident tickets in accordance with defined SLAs and escalation procedures.
Participates in continuous monitoring operations, including log correlation and alert tuning.
Maintains detailed documentation of all alerts, investigations, and response activities.
Supports daily and weekly reporting of security operations metrics and trends.
Adheres to established playbooks and incident handling procedures.
Maintains basic knowledge of cyber threat landscapes and emerging attack vectors.
As assigned, provides after-hours support by responding to and assisting with incidents as part of an on-call or escalation rotation.
Conducts advanced analysis and correlation of events across multiple data sources (endpoint, network, identity, and cloud).
Performs threat hunting activities leveraging MITRE ATT&CK and other intelligence frameworks.
Leads containment and eradication steps for medium-severity incidents.
Coordinates with IT and Security Engineering for incident response, remediation, and lessons learned.
Develops and refines security operations use cases and detection rules to reduce false positives and improve alert quality.
Maintains and improves security operations playbooks, runbooks, and standard operating procedures.
Conducts quality review of Analyst I investigations and provides coaching and feedback.
Contributes to weekly threat reports, metrics, and situational awareness briefings.
Participates in vulnerability management reviews and validation scans.
Collaborates with the Governance, Review and Compliance (GRC) team to support compliance evidence collection related to continuous monitoring controls.