Threat Detection and Response Analyst (Local)

Discover Vanderbilt University Medical Center:  Located in Nashville, Tennessee, and operating at a global crossroads of teaching, discovery, and patient care, VUMC is a community of individuals who come to work each day with the simple aim of changing the world. It is a place where your expertise will be valued, your knowledge expanded, and your abilities challenged. Vanderbilt Health is committed to an environment where everyone has the chance to thrive and where your uniqueness is sought and celebrated. It is a place where employees know they are part of something that is bigger than themselves, take exceptional pride in their work and never settle for what was good enough yesterday. Vanderbilt’s mission is to advance health and wellness through preeminent programs in patient care, education, and research.

Organization:

VEC TDR

Job Summary:

Conducts cyber threat intelligence, computer and network intrusion detection, incident response, and cybersecurity forensic investigations under occasional guidance. Conducts small and medium scale threat analysis for the environment. Troubleshoots and resolves complex security issues. Implements small and medium technology projects or components of large projects. Ability to solve medium to complex problems.

(Note: This role is a hybrid role, but candidates must live within a 4 hour radius of Nashville for on-site incident responses)

.

KEY RESPONSIBILITIES:

• Performs intrusion detection and incident response.

• Conducts computer investigations.

• Conducts threat analysis for the environment.

• The responsibilities listed are a general overview of the position and additional duties may be assigned.

TECHNICAL CAPABILITIES:

ANOMALY AND INTRUSION DETECTION :- Possesses sufficient fundamental proficiency to successfully demonstrate Intrusion and Anomaly Detection practices in practical applications of moderate difficulty. Has a basic understanding of network behavior analysis techniques and tools. Capable of using various detection systems and software.
 

INCIDENT RESPONSE :- Demonstrates the ability to respond quickly to reports from individuals. Takes immediate action to stop a cybersecurity incident from continuing or recurring. Determines whether an incident should be handled locally or reported to the IT Security Response Team. Works with the IT support staff to repair a system, restore service, and preserve evidence of the incident. Handles sensitive and other critical responses in a professional manner. Evaluates and documents investigation findings after resolving an incident.  Capable of using various computer forensic systems and software.

MALWARE ANALYSIS :- Possesses sufficient fundamental proficiency to successfully demonstrate Malware Analysis in practical applications of moderate difficulty. Has determined the behavior and purpose of a simple malware threat and eliminated it from the Company's computers. Familiar with Dynamic Analysis, the analysis of software during its execution on a computer or in a virtual machine, and Static Analysis, the method to look at the component without any execution on the component itself. Has used basic Malware Analysis tools and products.

NETWORK AND SYSTEMS FORENSICS :- Possesses sufficient fundamental proficiency to successfully demonstrate Digital Forensics capability on system and network data in practical applications of moderate difficulty.

THREAT DATA :- Proficient to review and collect pertinent Indicators of Compromise and other threat data from available sources (feeds, community communications, etc) to feed into existing Intrusion Detection systems and processes, to enhance discovery of threats in the environment.

SECURITY POSTURE ASSESSMENT :- Demonstrates the ability to successfully review basic Internet connections and internal networks to identify standard hacker/cracker threats. Able to review the configuration of server and major network applications to identify configuration errors and other problems that weaken organizational systems and increase their likelihood of misuse. Has conducted an assessment of at least one of the following: [1] access controls, governing access to applications and files, [2] password controls, determining permissible choice of passwords and governing the requirement to change passwords, [3] connectivity controls [e.g., open ports/ enabled protocols] influencing permissible communications to and from a computer system, [4] inappropriate files [including viruses, worms, Trojan horses, bootleg software, music files, inappropriate image files], and [5] unpatched software, bringing attention to available security-related patches that have not been deployed. Has basic knowledge of