Threat Defense Analyst L2

Job Summary

The Fortified Threat Defense Center provides 24x7x365 managed security services for healthcare customers. Members of the Threat Defense team are responsible for monitoring and alerting on key security technologies within each customer environment, identifying security events, performing analysis, creating new and tuning existing detection rules, and integrating with client’s incident response activities. In this role, the Threat Analyst 2 will monitor, detect, analyze, and report on security alerts discovered within Fortified Health Security’s customer infrastructures.

The Threat Analyst 2 will monitor various security technologies within these environments and report all investigated and validated findings to the proper customer in accordance with the approved communication plan.

Essential Job Functions

The following duties are normal for this position. The omission of specific statements of duties does not exclude them from being expected of this position if the work is similar, related, or a logical assignment for this position. Other duties may be required.

·PartnerwithclientsonservicedeliveryexecutionofallLOBsincludingbutnotlimitedto:

oManagedSIEM,Phishing,EDR,IoMT,&DLP

·Performanddocumentinitialincidentinvestigations.

·Presentalerts,metrics,andremediationtaskstocustomersviaapprovedcommunicationplans.

·Workwithassociatestocontinuallyimprovesecurityservicesthroughproducttuningandmaturity.

·Proactivelyanditerativelysearchthroughlogstodetectadvancedthreatsthat areunknowntothecurrentsecuritysolutions.

·Exercise high-level multi-taskingskillsbymanagingeventsinmultiplesystems,applications,andotherpriorities.

·Respondtoincidentsandclientinquirestimelyandprofessionally.

·Generateend-of-shiftreportsfordocumentationandknowledgetransfertosubsequentanalystsonduty.

·Remainuptodateonlatestsecuritythreatsandevents.

·Monitorthe“health”ofkeytechnologiesduringtheirshift.

·Intermediate/Advancedlevelunderstandingofthefollowingsubjectmatters

oIncidentResponse,AnalyticalIntelligence,PlaybookManagement,RelationshipManagement,TechnicalPresentation,Detection&SuppressionRuleManagement,Scripting(Python,Bash,PowerShell),ComplianceFrameworks(NIST,HIPAA,HITRUST,PCI)

·Advancedlevelunderstandingofthefollowingsubjectmatters

oAttack Frameworks, Troubleshooting & Root Cause Analysis, Advanced Documentation, Emotional Intelligence, Written and VerbalCommunication,SecurityPlatformHealthManagement,SecurityPlatform LogAnalysis,LinuxOS&Events,WindowsOS&Events,Healthcare Operational Knowledge, Endpoint Security Knowledge, Tools, & Best Practices, User Security Knowledge, Tools, & BestPractices, Network Security Knowledge, Tools, & Best Practices, Cloud Security Knowledge, Tools, & Best Practices, Data SecurityKnowledge,Tools,& BestPractices

·Fluentwithintrusiondetection/preventionsystems,firewalls,endpointdetection&responsesystems,anti-virussystems,DLP,vulnerabilitymanagement,creatingandmanaging phishingcampaigns,andcloudinfrastructure.

·Solidunderstandingofnetworksecurityconceptsanddefenseindepth.

·Knowledgeofsecurityincidentandeventmanagement(SIEM),loganalysis,networktrafficanalysis,malwareinvestigation/remediation,SIEMcorrelation logicandalertgeneration.

·Demonstratedabilitytoanalyze,triageandremediatesecurityincidents.

·Advancedknowledgeofcurrentthreatlandscape(threatactors,APT,cyber-crime,etc.).

·SolidunderstandingofOSImodel,networkprotocolsandinformationsecurityconcepts.

Knowledge & Skills

Education & Experience

• ·2+yearsofdirectInfoSecexperienceand/oranAssociate’s degreeinCS/MISpreferred.
• ·2+ years hands on experience with security tools such as scanners, monitoring and detection, malwareprotection,securityanalysistoolsandcompliancetools(bothnetworkandhost-basedsolutions).
• ·2+ years' technical experience in the security aspects of multiple computer platforms, operating systems,products,networkprotocolsandsystemarchitectureorequivalenttrainingandknowledgethrougheducation.

Special Skills & Knowledge

• ·AbilitytounderstandSIEMcorrelationrulesandcorrespondingalerts.
• ·Understanding of configuration and development of processes, procedures and practices for enterprisesecuritysystems,
• ·Prior experience and ability to demonstrate configuring SIEM applications / devices (ie. LevelBlue,Splunk).
• ·Capable of communication with clients via conference calls and/or emails to review and discussalertdataandsecurityreportfindings.
• ·FamiliaritywithMSOffice.
• ·StrongunderstandingofTCP/IP,includingIPv4subnetting.
• ·Intermediateunderstandingoffirewalls,IDS/IPS,antivirus,syslog,VPN,RDP,SSHandTelnet.
• ·ProficientabilitytorunandtroubleshootPowerShell/BASH/Pythonscripts.
• ·SecurityCertificationssuchasCompTIASecurity+,SANS,orCISCOareaPLUS.
• ·Abilitytodocumentandcommunicateinaclear,concise,andeffectivemanner.
• ·Intermediate/Advanced understandingofcomplianceframeworks(i.e.,NIST,HIPAA,HITRUST,PCI).
• Licenses, Certifications, etc.

Requirements

Supervisory Responsibility

·N/A

Working Conditions & Travel Requirements

·Two shifts will be available, swing shift 3:00pm to 12am CST, and night shift 11pm to 8am.

Fortified Health Security is an Equal Opportunity Employer. In compliance with the Americans with Disabilities Act, Fortified Health Security will provide reasonable accommodations to qualified individuals with disabilities. If a reasonable accommodation is needed to perform this position, you need to inform Fortified Health Security People and Culture Team of such request. Signatures below indicate the receipt and review of this job description by the associate assigned to the position and the People and Culture Team.