Senior Security Operations Analyst

Alma is on a mission to simplify access to high-quality, affordable mental health care. We do this by making it easy and financially rewarding for therapists to accept insurance and offer in-network care. When a provider joins Alma, they gain access to a suite of tools that not only help them better run their business, but also grow it sustainably and develop as a provider. Alma is available in all 50 states, with over 20,000 therapists in our growing network. Anyone looking for a therapist can browse Alma’s free directory. Alma has raised $220.5M in funding from Insight Partners, Optum Ventures, Tusk Venture Partners, Primary Venture Partners, First Round Capital, Sound Ventures, BoxGroup, Cigna Ventures, and Rainfall Ventures. Alma was also named one of Inc’s Best Workplaces in 2022 and 2023.

Senior Security Operations Analyst

Alma is seeking a mission-driven Senior Security Operations Analyst to join our team.  We are dedicated to building and operating secure and compliant tools and services which help providers more easily manage and grow their practice. In this role, you will help us defend against cybersecurity incidents by identifying, analyzing, communicating and containing incidents as they occur.

The ideal person for this role loves to research tactics, techniques and procedures (TTPs) leveraged by attackers and adversaries and works with other teams to mature Alma’s incident response program, defining standards, procedures and automating processes to uncover, resist and recover from security incidents.

What you’ll do:

• Defend against cybersecurity incidents and identify, analyze, communicate and contain incidents as they occur.
• Validate and maintain incident response plans and processes to address potential threats
• Conduct network monitoring, intrusion detection analysis, and log-based and endpoint-based threat detection to detect and protect against threats coming from multiple sources
• Deploy and manage cloud-centric detection to detect threats related to cloud environments and services used by the organization
• Work with the security information and event management (SIEM) system to correlate activity across assets (endpoint, network, apps) and environments (on-premises, cloud) and identify patterns of anomalous activity
• Research emerging threats and vulnerabilities to aid in the identification of incidents
• Create runbooks for frequently occurring incidents and alerts to automate or assist with the resolution of those cases
• Provide users with incident response support, including mitigating actions to contain activity and facilitating forensics analysis when necessary

Who you are:

• You have 4+ years of experience working in a similar role with web technologies and information security and at least 2 years working in a senior role
• You are self-motivated and capable of driving efforts to completion with minimal oversight while knowing when to ask for guidance and assistance as needed
• You have achieved Certified Information Systems Security Professional (CISSP) certification or other relevant certifications
• You have extensive experience managing incidents from detection to remediation including documenting findings, managing the response team and process, communicating updates, leading remediation efforts, and performing retrospectives for process improvement
• You have experience building and running incident response programs, including planning tabletop exercises, developing breach simulation scenarios, facilitating tabletop sessions with numerous stakeholders, and writing summary reports
• You have experience working with an incident management tool like OneTrust
• You deeply understand AWS security tools and processes in regards to monitoring, logging, and incident management
• You have multiple years of experience monitoring security systems that can scale, with high levels of automation.
• You have extensive experience deploying and tuning the Elastic security information and event management (SIEM) platform and Endpoint Detect and Response (EDR) tool or a similar product