Lead Cyber Security Analyst

Full Time

Job Description

Resp & Qualifications


CareFirst, Inc., and its affiliated companies, generally referred to as CareFirst BlueCross BlueShield (CareFirst), is the Mid-Atlantic region’s largest private sector health insurer, serving the healthcare needs of 3.5 million members in Maryland, the District of Columbia, and portions of northern Virginia. The Company offers a comprehensive portfolio of products and services to individuals and groups, as well as state and federal government sponsored plans. With a market share almost three times that of the closest competitor, the company commands 45 percent penetration across the region.

In July 2018, Brian D. Pieninck assumed the role of President and CEO after serving as the company’s COO of Strategic Business Units and IT Division. Under his leadership, the organization completed an extensive review of its operations and clinical programs, resulting in an expansive 3-year strategy to grow and diversify the company’s core business. Along with a 5-year vision to drive the transformation of the healthcare experience across the continuum of its members, partners, and communities, the company has placed a renewed and intentional focus on fostering a mission-based culture, which drives every decision the company makes. The organization employs over 5,600 full-time employees in Maryland, Northern Virginia, the District of Columbia, and West Virginia. CareFirst has earned multiple workplace awards recognizing its leadership in diversity and inclusion, wellness engagement, and creation of a supportive and equitable work environment for all employees.

At CareFirst, you are part of an inspired, collaborative team that is building the healthcare experience we want for our families and our future. Every day, we make a meaningful difference in the communities where we live and work.

We practice empathy, seek to understand, invest in inclusion, demand equity and nurture belonging every day for our employees and the communities we serve. We rely on the rich diversity of our employees’ experiences and backgrounds to achieve our mission. Every year we host a Week of Equity and Action where we deepen our investment and commitment to diversity, equity, and inclusion. During this week thousands of employees engage in workshops and volunteerism with the goal of bettering themselves and our community.
  • Women make up around 70% of CareFirst’s employee population, and over 50% identify as BIPOC (Black, Indigenous, and people of color).
  • We have 9 resource groups that connect employees over shared identities (LGBTQ, veteran status, race, etc.) and passions (climate change, healthy living, leadership development).
  • Employees are encouraged to give back and volunteer in their communities with their civic engagement hours.

As a not-for-profit, CareFirst regularly ranks among the most philanthropic organizations with $65 million invested in the community in 2020 to improve overall health, and increase the accessibility, affordability, safety, and quality of healthcare throughout its market area. The company’s employees consistently add to this impact by devoting thousands of volunteer hours to numerous community organizations and social causes. The company’s continued efforts to reinvest in community health care programs has repeatedly earned CareFirst regional accolades as a leading corporate philanthropist, including the No. 2 and No. 7 spots on the Baltimore Business Journal and Washington Business Journal’s 2019 list of top corporate givers, respectively.


The Lead CyberSecurity Analyst is responsible for the monitoring, detection, and analysis of security threats against the distributed enterprise network. The selected candidate should have proven experience and the ability to leverage Computer Network Defense/Blue Team (CND) analyst toolsets to detect and respond to Cyber security incidents. This role conducts research and documents threats and their behavior; provides recommendations for threat mitigation strategies; employs effective communications to clearly manage security incident response procedures; and performs routine event reporting including trend reporting and analysis.

PRINCIPLE ACCOUNTABILITIES: Under the direction of the Manager, CyberSecurity Monitoring, the incumbent is responsible for, but is not limited to, the following:

Duties and Responsibilities:
  • Monitor consoles and telemetry directly from a variety of security toolsets and from the SIEM.
  • Thoroughly investigate and document security events.
  • Audit and review system reports and security logs for unauthorized access, noncompliant activity, or access misuse.
  • Monitor and escalate incoming security requests and events of interest from different external and internal sources.
  • Follow standard operating procedures for detecting, classifying, and reporting incidents.
  • Develop or improve use cases to increase efficacy, performance, or outcomes for security monitoring.
  • Participate in incident response activities as necessary.
  • Triage (determine scope, severity, and priority) of events in Security Information and Event Management (SIEM) tool or within other security monitoring tools directly.
  • Research vulnerabilities in applications and systems. Provide recommendations for resolution and track remediation activities.
  • Traffic analysis (at the packet level) and reconstruction of network traffic to discover anomalies, trends, and patterns affecting the customer's networks.
  • Analyze firewall logs, Full Packet Capture (PCAP), IDS alerts, Anti-malware alerts, Host Intrusion Prevent System (HIPS), and server and application logs to investigate events and incidents for anomalous activity and produce reports of findings.
  • Coordinate with third party providers to ensure appropriate detections are built and deployed.
  • Coordinate with Threat Intelligence and Response Operations to enhance time to detection and response.


Required Education and Experience: Degree or equivalent experience: BA/BS in Information Technology, CyberSecurity, Networking, Information Security, MIS, Computer Science or related field.

Experience Level: Minimum 5 years of demonstrated work experience. (Additional experience may be substituted for educational requirement.)

Along with the basic qualifications, the candidate will need to have experience in the following areas:
  • Deployment, configuration and management of Endpoint Detection and Response (EDR/XDR) tools, such as CrowdStrike.
  • Experience managing Microsoft Defender for Endpoint.
  • Experience in a hybrid multi-cloud environment – Azure highly preferred.
  • Experienced in the application and usage of threat analysis models/frameworks such as the Cyber Kill Chain, MITRE ATT&CK, etc.
  • Advanced knowledge of threat Tactics, Techniques and Procedures (TTPs), especially in cloud environments and including SaaS services like M365.

Specialized training (preferred, but not required): Transitioning, maintaining, or using security technologies such as Security Incident and Event Management (SIEM), Endpoint protection, Data Loss Prevention, Forensic tools, Network Anomaly Detection, Packet Capture Analysis; Incident response principles or related technical domain that is applied in the context of a broader understanding of CSIRT and related systems and processes.

Licenses/Certifications:One or more of the following certifications are preferred but not requiredOR the ability to obtain one certification within 6 months.

GCIA (GIAC Certified Intrusion Analyst)

GMON (GIAC Continuous Monitoring)

GCIH (GIAC Certified Incident Handler)

CCFA (CrowdStrike Certified Falcon Administrator)

GSOC (GIAC Security Operations Certified

CCFR (CrowdStrike Certified Falcon Responder)

Microsoft Certified: Security Operations Analyst Associate

CCFH (CrowdStrike Certified Falcon Hunter)

Knowledge, Skills and Abilities (KSAs)
  • Must be able to effectively work in a fast-paced environment with frequently changing priorities, deadlines, and workloads that can be variable for long periods of time. Must be able to effectively communicate.
  • Incumbent must have a firm understanding of Information and/or Cyber Security principles. Must be able to adapt quickly to understand rapidly changing threat landscape in order to correctly scope and prioritize security events. The incumbent must also be able to achieve certification across multiple domains such as networking, security, development languages, etc.

Required skills:
  • Experience preventing, detecting, analyzing and responding to threats against sensitive information.
  • Experience triaging security, network and endpoint forensic analysis, threat hunting and vulnerability escalation.
  • Experience with security monitoring and reporting tools and conducting security investigations of incidents and events.
  • Critical thinking and analytical skills to develop enhanced workflows and use cases for next generation platforms and cloud technology.
  • Experience with analyzing large data sets and log files to find correlations and anomalies.
  • Ability to utilize native cloud security tools in Azure to design and implement continuous monitoring solutions.
  • Advanced knowledge and use of Splunk.

Preferred Skills:
  • Ability to script proficiently in either Python or PowerShell
  • Advanced knowledge and use of Linux
  • OSINT collection and analysis.


Department:InfoSec - CyberSecurity

Equal Employment Opportunity

CareFirst BlueCross BlueShield is an Equal Opportunity (EEO) employer. It is the policy of theCompany to provide equal employment opportunities to allqualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veteran or disabled status, or genetic information.

Hire Range Disclaimer

Actual salary will be based on relevant job experience and work history.

Where To Apply

Please visit our website to apply: www.carefirst.com/careers

Federal Disc/Physical Demand

Note: The incumbent is required to immediately disclose any debarment, exclusion, or other event that makes him/her ineligible to perform work directly or indirectly on Federal health care programs.


The associate is primarily seated while performing the duties of the position. Occasional walking or standing is required. The hands are regularly used to write, type, key and handle or feel small controls and objects. The associate must frequently talk and hear. Weights up to 25 pounds are occasionally lifted.

Sponsorship in US

Must be eligible to work in the U.S. without Sponsorship

Dice Id : 10233586
Position Id : 16754-1A
Originally Posted : 3 months ago
Have a Job? Post it

Similar Positions

Lead Cyber Security Operations Analyst
  • CareFirst
  • Owings Mills, MD, USA
Lead Cyber Security Engineer
  • CareFirst
  • Owings Mills, MD, USA
Cybersecurity Intelligence Fusion Analyst
  • Zachary Piper Solutions, LLC
  • Fort Meade, MD, USA
Cyber Security Fusion Analyst
  • Leidos
  • Fort Meade, MD, USA
Senior Cyber Security Analyst
  • CareFirst
  • Owings Mills, MD, USA
Lead Cyber Security Engineer
  • CareFirst
  • Owings Mills, MD, USA
Cybersecurity Lead Analyst
  • Guidehouse
  • Washington, DC, USA
Cybersecurity Analyst- Secret Cleared
  • Data Systems Analysts Inc. (DSA)
  • Aberdeen, MD, USA
Cyber- Security Data Engineering Lead
  • Favor TechConsulting, LLC
  • Washington, DC, USA