Security Incident Response Analyst Sr

INTEGRIS Health Two Corporate Plaza Bldg., Oklahoma’s largest not-for-profit health system has a great opportunity for a Security Incident Response Analyst Sr. in Oklahoma City, OK.  In this position, you’ll be a part of our IT Standards team providing exceptional work supporting the INTEGRIS Health caregivers and the community at large.  If our mission of partnering with people to live healthier lives speaks to you, apply today and learn more about our recently enhanced benefits package for all eligible caregivers such as, front loaded PTO, 100% INTEGRIS Health paid short term disability, increased retirement match, and  paid family leave. We invite you to join us as we strive to be The Most Trusted Partner for Health. ​​

The Security Incident Response Analyst Sr. is a senior level role within the Cyber Fusion Center and will be responsible for developing and executing standards, procedures, and processes to uncover, resist and recover from security incidents.

 

The Sr. Security Incident Response Analyst will be responsible for the following activities and functions:

• Responds to computer security incidents according to the computer security incident response policy and procedures.
• Provides technical guidance to first responders for handling information security incidents.
• Provides timely and relevant updates to appropriate stakeholders and decision makers.
• Communicates investigation findings to relevant business units to help improve the information security posture.
• Validates and maintains incident response plans and processes to address potential threats.
• Compiles and analyzes data for management reporting and metrics.
• Monitors relevant information sources (such as Twitter, LinkedIn and information sharing and analysis centers) to stay up to date on current attacks and trends.
• Analyzes potential impact of new threats and communicates risks back to detection engineering functions.
• Performs root-cause analysis to document findings in CSIRT Reports and participate in root-cause elimination activities as required.
• Mentor junior level staff and be a thought leader within the Security Operations Center

A successful candidate will have the expertise, and skills described below.

• Bachelor's degree in computer science or a related field and 6+ years in security incident response in a Security Operations Center or a Cyber Fusion Center with increasing levels of responsibility.
• Triages and assesses the risk of incidents, performing real-time analysis and managing workload during investigations/incidents.
• Creates runbooks for frequently occurring incidents to automate or at least assist with the resolution of those cases.
• Create organized and well-written after action, CSIRT and RCA reports.
• Understands common security concerns, vulnerabilities, and exploitation techniques to think like an attacker and guard against those attack vectors.
• Proficiency with at least at least one scripting language (e.g., Python, PowerShell) to perform SOAR automation playbooks. 
• Strong documentation skills, especially when writing up CSIRT reports for Executive Leadership.

Preferred

• One or more of the following certifications specific to Incident Response: EC-Council Certified Incident Handler (ECIH), GIAC Certified Incident Handler (GCIH), CREST Registered Intrusion Analyst (CRIA), or COMPTIA Cybersecurity Analyst (CySA+)
• Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), and/or Global Information Assurance Certification or capability to show relevant experience.