Security Analyst

Discover Vanderbilt University Medical Center:  Located in Nashville, Tennessee, and operating at a global crossroads of teaching, discovery, and patient care, VUMC is a community of diverse individuals who come to work each day with the simple aim of changing the world. It is a place where your expertise will be valued, your knowledge expanded, and your abilities challenged. Vanderbilt Health recognizes that diversity is essential for excellence and innovation. We are committed to an inclusive environment where everyone has the chance to thrive and where your diversity of culture, thinking, learning, and leading is sought and celebrated. It is a place where employees know they are part of something that is bigger than themselves, take exceptional pride in their work and never settle for what was good enough yesterday. Vanderbilt’s mission is to advance health and wellness through preeminent programs in patient care, education, and research.

Organization:

VEC SOC

Job Summary:

Conducts computer forensic investigations, data recovery and electronic discovery under occasional guidance. Conducts small and medium scale vulnerability assessments and threat analysis for the environment. Troubleshoots and resolves complex security issues. Implements small and medium technology projects or components of large projects. Ability to solve medium to complex problems.

.

KEY RESPONSIBILITIES
• Conducts computer investigations.
• Responds and/or mitigates security breaches and attacks to the infrastructure.
• Conducts vulnerability and threat analysis for the environment.
• The responsibilities listed are a general overview of the position and additional duties may be assigned.

TECHNICAL CAPABILITIES
• Anomaly Detection (Novice): Possesses sufficient fundamental proficiency to successfully demonstrate Anomaly Detection practices in practical applications of moderate difficulty. Has a basic understanding of network behavior analysis techniques and tools. Capable of using Intrusion Detection Systems software.
• Network Forensics (Novice): Possesses sufficient fundamental proficiency to successfully demonstrate Network Forensics in practical applications of moderate difficulty.
• Incident Response (Novice): Demonstrates the ability to respond quickly to reports from individuals. Takes immediate action to stop an incident from continuing or recurring. Determines whether an incident should be handled locally or reported to the IT Security Response Team. Works with the IT support staff to repair a system, restore service, and preserve evidence of the incident. Handles sensitive and other critical responses in a professional manner. Evaluates and documents investigation findings after resolving an incident.
• Malware Analysis (Novice): Possesses sufficient fundamental proficiency to successfully demonstrate Malware Analysis in practical applications of moderate difficulty. Has determined the behavior and purpose of a simple malware threat, and eliminated it from the Company's computers. Familiar with Dynamic Analysis, the analysis of software during its execution on a computer or in an virtual machine, and Static Analysis, the method to look at the component without any execution on the component itself. Has used basic Malware Analysis tools and products.
• Vulnerability Assessments (Novice): Demonstrates the ability to successfully review basic Internet connections and internal networks to identify standard hacker/cracker threats. Able to review the configuration of server and major network applications to identify configuration errors and other problems that weaken organizational systems and increase their likelihood of misuse. Has conducted an assessment of at least one of the following: [1] access controls, governing access to applications and files, [2] password controls, determining permissible choice of passwords and governing the requirement to change passwords, [3] connectivity controls [e.g., open ports/ enabled protocols] influencing permissible communications to and from a computer system, [4] inappropriate files [including viruses, worms, Trojan horses, bootleg software, music files, inappropriate image files], and [5] unpatched software, bringing attention to available security-related patches that have not been deployed. Has basic knowledge of several of the following: network foot-printing, port scanning, and enumeration techniques, specific operating system vulnerabilities [like Win-NT, *nix,Win-2K, Solaris], web server vulnerabilities, application level exploits, worms, viruses, and Trojans, network vulnerabilities, sniffing, wireless sniffing, IP spoofing, and PPTP/VPN breaking. Generate security reports for management that show system safety and incident reporting.

Our professional administrative functions include critical supp