Cyber Security Analyst III, Detection

We are so glad you are interested in joining Sutter Health!

Organization:

SHSO-Sutter Health System Office-Valley

Position Overview:

As a Cybersecurity Detection/Red Team Analyst at Level 3, you will play a dual-role in simulating adversarial behavior to identify security gaps and enhancing detection capabilities to defend against real-world threats. This role requires advanced technical expertise in offensive security tactics and the ability to improve detection frameworks by analyzing vulnerabilities and attack simulations.

Key Responsibilities:

Red Team Operations

Design and execute advanced adversary emulation scenarios to simulate real-world attack tactics, techniques, and procedures (TTPs).
Identify vulnerabilities in infrastructure, applications, and processes through simulated attacks.
Develop detailed reports on findings, including remediation recommendations to reduce risks.
Detection Engineering

Collaborate with the Blue Team to create and fine-tune detection rules based on observed attack patterns.
Validate the effectiveness of detection mechanisms by simulating known and emerging threats.
Enhance SIEM, EDR, and other monitoring tools by integrating custom detection logic.
Threat Analysis & Response

Analyze attacker methodologies to improve the organization’s understanding of threats.
Provide insights into potential gaps in visibility and propose strategies to close those gaps.
Support incident response teams by providing technical expertise during investigations.
Collaboration & Mentorship

Work closely with threat intelligence teams to incorporate threat data into red team exercises and detection workflows.
Mentor junior analysts in red teaming techniques and detection methodologies.
Partner with IT and DevSecOps teams to improve system configurations and hardening practices.
Continuous Improvement

Stay updated on the latest attacker TTPs and emerging technologies in offensive and defensive security.
Evaluate and implement tools to enhance red teaming and detection capabilities.
Conduct post-assessment reviews to measure the impact and effectiveness of simulations.
Documentation & Reporting

Create comprehensive reports detailing red team exercises, vulnerabilities identified, and recommended fixes.
Maintain clear documentation of detection rules, attack simulations, and findings.
Present technical findings to stakeholders and provide actionable insights to strengthen security posture.

Job Description:

EDUCATION:
Equivalent experience will be accepted in lieu of the required degree or diploma.

• Bachelor's in Business, Cybersecurity, Computer Science, Information Technology/Security, Risk Management, or related field

TYPICAL EXPERIENCE:

• 5 years recent relevant experience.

• Experience providing cyber security support by planning, coordinating, integrating, and synchronizing cyber defense and prevention activities preferred.

• Experience ensuring compliance with all applicable state and federal cyber laws and regulations preferred

• Experience creating comprehensive and accurate reports that communicate risk profile impacts to peers and management preferred.

SKILLS AND KNOWLEDGE:

• In-depth understanding of the anatomy of an attack and the lifecycle of a network threat and network vulnerability exploitation in a healthcare environment.

• Technical skills in planning, administration, and management of information systems; operational and technical security controls; and security risk analysis and management, including end point security controls, such as access control lists (ACLS), host intrusion prevention system (HIPS), registry, logging, and forensics.

• Comprehensive knowledge of end point security technologies (Antivirus, Forensics, Anti-malware, HIPS), data loss prevention (DLP) methodologies, DLP technologies, current information security trends and practices including security processes, methods, and procedures.

• Thorough knowledge of software, hardware, databases, networks, firewalls, encryption, and other systems security devices, including a good understanding of end point operating systems (Windows and Linux), internet technologies such as Domain Name System (DNS), routing, Simple Mail Transfer Protocol (SMTP), Hypertext Transfer Protocol (HTTP), Dynamic Host Configuration Protocol (DHCP), and File Transfer Protocol (FTP), and familiarity in a command line environment.

• Expert knowledge of state and federal information services (IS) security and privacy-related regulatory requirements and laws.

• Detailed knowledge regarding National Institute of Standards and Te