Cybersecurity Incident Response Analyst IISumma Health Full-Time / Benefit EligibleRemote Opportunity - Hybrid preferred Summa Health is strengthening how we defend the systems our patients and caregivers depend on, and we're looking for someone who will help investigate, contain, and recover, often with a clock running. If you've worked in a security environment, you know the feeling of everything getting loud at once. We want the person who stays calm through it. You'll need the judgment to make decisions with incomplete information, and the communication skills to keep clinicians, leaders, and engineers aligned and informed. We respond with urgency, own what we find, and would rather act decisively and learn from it than wait for certainty.
Summary:
Under general direction of the Manager, Cybersecurity Operations, the Cybersecurity Incident Response Analyst II is responsible for performing the tasks that support incident detection, incident response, digital forensics, and threat intelligence capabilities across the organization.
The Cybersecurity Incident Response Analyst performs real-time cybersecurity event analysis and incident handling activities in order to identify, contain, and mitigate cybersecurity incidents relevant to the organization. The role conducts incident preparedness activities to ensure the organization is positioned to respond to cybersecurity incidents in a manner that maximizes the survival of life, preservation of property, and information security. The Cybersecurity Incident Response Analyst is responsible for documenting cybersecurity incident activity from initial detection through recovery.
The Cybersecurity Incident Response Analyst performs cybersecurity incident triage tasks, including determining scope, urgency, and potential impact; identifies specific vulnerabilities exploited; and makes recommendations that enable expeditious remediation. The role performs command and control tasks to support interdepartmental virtual incident response team activities.
The Cybersecurity Incident Response Analyst performs digital forensics duties for the organization. Digital forensics duties entail investigations of computer-based incidents, establishing documentary evidence, including digital media and logs associated with cyber incidents.
The Cybersecurity Incident Response Analyst also operates the organization's threat intelligence capabilities which includes monitoring and developing cyber indicators to maintain awareness of the threat status across a highly dynamic operating environment. The role collects, processes, analyzes, and disseminates cyber threat alerts & warnings.
Formal Education Required:
a. Bachelor's Degree or equivalent in Computer Science, Cybersecurity, IT, or Engineering or equivalent combination of education and/or experience.
Experience & Training Required:
a. Five (5) years information security experience; Five (5) years of IT related experience; Experience working in a complex healthcare environment.
b. Certifications required:
i. CompTIA Security+ (or equivalent)
ii. CompTIA CASP (or equivalent)
c. Certifications preferred:
i. GIAC Incident Handler (GCIH) (or equivalent)
ii. GIAC Certified Forensic Analyst (GCFA) (or equivalent)
Other Skills, Competencies and Qualifications:
a. Advanced knowledge of computer networking concepts and protocols, and network security methodologies.
b. Intermediate knowledge of front-end collection systems, including network traffic collection, filtering, and selection.
c. Intermediate knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).
d. Intermediate knowledge of what constitutes a network attack and a network attack's relationship to both threats and vulnerabilities.
e. Intermediate knowledge of incident response and handling methodologies.
f. Intermediate knowledge of common adversary tactics, techniques, and procedures (TTPs) in assigned area of responsibility (e.g., historical country-specific TTPs, emerging capabilities).
g. Intermediate knowledge of cyber threats and vulnerabilities.
h. Intermediate knowledge of incident categories, incident responses, and timelines for responses.
i. Intermediate knowledge of cyber-attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
j. Intermediate knowledge of processes for collecting, packaging, transporting, and storing electronic evidence while maintaining chain of custody.
k. Intermediate knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.
l. Intermediate knowledge of security event correlation tools.
m. Intermediate knowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
n. Intermediate knowledge of common computer/network infections (virus, Trojan, etc.) and methods of infection (ports, attachments, etc.).
o. Basic knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
p. Basic knowledge of cybersecurity and privacy principles.
q. Basic knowledge of server and client operating systems.
r. Basic knowledge of how to extract, analyze, and use metadata.
s. Basic knowledge of malware.
t. Basic knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
u. Basic knowledge of data backup and recovery.
v. Basic knowledge of encryption algorithms.
w. Intermediate skill to identify cybersecurity and privacy issues that stem from connections with internal and external customers and partner organizations.
x. Intermediate skill in using security event correlation tools.
y. Intermediate skill in collecting, processing, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.
z. Intermediate skill in using forensic tool suites.
aa. Intermediate skill in analyzing anomalous code as malicious or benign.
bb. Intermediate skill in processing digital evidence, to include protecting and making legally sound copies of evidence.
cc. Intermediate skill in performing packet-level analysis.
dd. Intermediate skill in evaluating information for reliability, validity, and relevance.
ee. Intermediate skill in identifying cyber threats which may jeopardize organization and/or partner interests.
ff. Intermediate skill in utilizing virtual collaborative workspaces and/or tools (e.g., IWS, VTCs, chat rooms, SharePoint).
gg. Intermediate skill in using scientific rules and methods to solve problems.
hh. Basic skill in analyzing volatile data.
ii. Basic skill in interpreting results of debugger to ascertain tactics, techniques, and procedures.
jj. Ability to interpret the information collected by network tools (e.g. Nslookup, Ping, and Traceroute).
kk. Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
ll. Ability to evaluate information for reliability, validity, and relevance.
mm. Ability to evaluate, analyze, and synthesize large quantities of data (which may be fragmented and contradictory) into high quality, fused targeting/intelligence products.
nn. Ability to function effectively in a dynamic, fast-paced environment.
oo. Ability to function in a collaborative environment, seeking continuous consultation with other analysts and experts-both internal and external to the organization-to leverage analytical and technical expertise.
pp. Ability to think critically.
qq. Ability to think like threat actors.
rr. Ability to develop productive working relationships with a broad range of business, clinical, and operational professionals.
ss. Ability to negotiate resolutions for conflicting security and business objectives.
tt. Ability to exemplify Summa Health's core values.
uu. Ability to take direction and operate independently in moderately ambiguous situations.
vv. Ability to effectively interact with populations of patients/customers with an understanding of their needs for self-respect and dignity.
Level of Physical Demands:
a. Sedentary: Exerts up to ten pounds of force occasionally and/or a negligible amount of force frequently.
b. Minimal, may occasionally move computer equipment (desktop, laptop, monitor, printer, and peripherals) when necessary.
Summa Health System is recognized as one of the region's top employers by a number of third party organizations, including NorthCoast 99. Exceptional candidates gravitate to Summa because of its culture, passion for delivering excellent service to our patients and families commitment to our philosophy of servant leadership, collegial working relationships at every level of the organization and competitive pay and benefits.
Equal Opportunity Employer/Veterans/Disabled
$37.40/hr - $56.11/hr
The salary range on this job posting/advertising is base salary exclusive of any bonuses or differentials. Many factors, such as years of relevant experience and geographical location are considered when determining the starting rate of pay. We believe in the importance of pay equity and consider internal equity of our current team members when determining offers. Please keep in mind that the range that is listed is the full base salary range. Hiring at the maximum of the range would not be typical.
Summa Health offers a competitive and comprehensive benefits program to include medical, dental, vision, life, paid time off as well as many other benefits.
- Basic Life and Accidental Death & Dismemberment (AD&D)
- Supplemental Life and AD&D
- Dependent Life Insurance
- Short-Term and Long-Term Disability
- Accident Insurance, Hospital Indemnity, and Critical Illness
- Retirement Savings Plan
- Flexible Spending Accounts - Healthcare and Dependent Care
- Employee Assistance Program (EAP)
- Identity Theft Protection
- Pet Insurance
- Education Assistance
- Daily Pay
#LI-AW1
