Fox Point Recruitment LLC
Senior Incident Response Analyst
Fox Point Recruitment LLC, Saint Louis, Missouri, United States, 63146
About the job Senior Incident Response Analyst
Job Purpose
Resolves security incidents, recommending enhancements to improve security, identifying common attack patterns to publicly exposed aspects of the organization's environment, and contributing to the implementation of scalable and preventative security measures. Executes enterprise-wide Incident Response Plan. Partners with business units to accomplish enterprise-wide remediation and develops and delivers presentations to senior leadership team.
Location REMOTE St. Louis, MO
Job Tasks
Reviews current configurations of the organization's production information systems and networks against compliance standards
Prepares the prevention and resolution of security breaches and ensure incident and response management processes are initiated
Implements and discusses security service audit schedules, review access authorization, and perform the required access controls testing to identify security shortfalls
Designs automated scripts, contingency plans, and other programmed responses which are launched when an attack against systems has been detected
Collaborates with Information Security Architects, Information Security Engineers, and software or hardware stakeholders at Centene
Notifies internal and/or external teams according to agreed alert priority levels, escalation trees, triaging of security alerts, events, and notifications
Ties third party attack monitoring services and threat reporting services into internal CIRT (Cyber Incident Response Team) communications systems
Performs post-mortem analysis with logs, network traffic flows, and other recorded information to identify intrusions by unauthorized parties, as well as unauthorized activities of authorized users
Performs other duties as assigned
Complies with all policies and standards
Education/Experience A Bachelor's degree in a quantitative or business field (e.g., statistics, mathematics, engineering, computer science). Requires 4 to 6 years of related experience.
OR equivalent experience acquired through accomplishments of applicable knowledge, duties, scope and skill reflective of the level of this position.
Technical Skills
4-6 years of Cloud cybersecurity experience performing incident triage and response
Intermediate-to-advanced understanding of AWS and Azure environments
Knowledge of tools, techniques, and processes (TTP) used by threat actors
Knowledge of Indicators of compromise (IOC)
Knowledge of Wiz & Wiz Defend
Experience with Endpoint protection and enterprise detection & response software (such as CrowdStrike, MS Defender, etc.)
Knowledge of Network and infrastructure technologies including routers, switches, firewalls, etc.
Soft Skills
Intermediate - Seeks to acquire knowledge in area of specialty
Intermediate - Ability to identify basic problems and procedural irregularities, collect data, establish facts, and draw valid conclusions
Intermediate - Ability to work independently
Intermediate - Demonstrated analytical skills
Intermediate - Demonstrated project management skills
Intermediate - Demonstrates a high level of accuracy, even under pressure
Intermediate - Demonstrates excellent judgment and decision making skills
License/Certification
SANS GIAC Security Essentials (GSEC), SANS GIAC Certified Intrusion Analyst (GCIA) or equivalent, SANS GIAC Certified Incident Handler (GCIH) or equivalent preferred.
Benefits The company offers a comprehensive benefits package including: competitive pay, health insurance, 401K and stock purchase plans, tuition reimbursement, paid time off plus holidays, and a flexible approach to work with remote, hybrid, field or office work schedules. Actual pay will be adjusted based on an individual's skills, experience, education, and other job-related factors permitted by law, including full-time or part-time status. Total compensation may also include additional forms of incentives. Benefits may be subject to program eligibility.
#J-18808-Ljbffr
Location REMOTE St. Louis, MO
Job Tasks
Reviews current configurations of the organization's production information systems and networks against compliance standards
Prepares the prevention and resolution of security breaches and ensure incident and response management processes are initiated
Implements and discusses security service audit schedules, review access authorization, and perform the required access controls testing to identify security shortfalls
Designs automated scripts, contingency plans, and other programmed responses which are launched when an attack against systems has been detected
Collaborates with Information Security Architects, Information Security Engineers, and software or hardware stakeholders at Centene
Notifies internal and/or external teams according to agreed alert priority levels, escalation trees, triaging of security alerts, events, and notifications
Ties third party attack monitoring services and threat reporting services into internal CIRT (Cyber Incident Response Team) communications systems
Performs post-mortem analysis with logs, network traffic flows, and other recorded information to identify intrusions by unauthorized parties, as well as unauthorized activities of authorized users
Performs other duties as assigned
Complies with all policies and standards
Education/Experience A Bachelor's degree in a quantitative or business field (e.g., statistics, mathematics, engineering, computer science). Requires 4 to 6 years of related experience.
OR equivalent experience acquired through accomplishments of applicable knowledge, duties, scope and skill reflective of the level of this position.
Technical Skills
4-6 years of Cloud cybersecurity experience performing incident triage and response
Intermediate-to-advanced understanding of AWS and Azure environments
Knowledge of tools, techniques, and processes (TTP) used by threat actors
Knowledge of Indicators of compromise (IOC)
Knowledge of Wiz & Wiz Defend
Experience with Endpoint protection and enterprise detection & response software (such as CrowdStrike, MS Defender, etc.)
Knowledge of Network and infrastructure technologies including routers, switches, firewalls, etc.
Soft Skills
Intermediate - Seeks to acquire knowledge in area of specialty
Intermediate - Ability to identify basic problems and procedural irregularities, collect data, establish facts, and draw valid conclusions
Intermediate - Ability to work independently
Intermediate - Demonstrated analytical skills
Intermediate - Demonstrated project management skills
Intermediate - Demonstrates a high level of accuracy, even under pressure
Intermediate - Demonstrates excellent judgment and decision making skills
License/Certification
SANS GIAC Security Essentials (GSEC), SANS GIAC Certified Intrusion Analyst (GCIA) or equivalent, SANS GIAC Certified Incident Handler (GCIH) or equivalent preferred.
Benefits The company offers a comprehensive benefits package including: competitive pay, health insurance, 401K and stock purchase plans, tuition reimbursement, paid time off plus holidays, and a flexible approach to work with remote, hybrid, field or office work schedules. Actual pay will be adjusted based on an individual's skills, experience, education, and other job-related factors permitted by law, including full-time or part-time status. Total compensation may also include additional forms of incentives. Benefits may be subject to program eligibility.
#J-18808-Ljbffr