Cyber Security Operations Center (CSOC) Analyst- Tier 3

Join us as we work to create a thriving ecosystem that delivers accessible, high-quality, and sustainable healthcare for all. The Information Security group at athenahealth is looking for a security analyst to join our Cyber Security Operations Center (CSOC) team. This is a highly technical, hands-on role that acts as a top-tier (Tier 3) incident responder for cyber security incidents of all types, detection engineering, threat hunting, and serves as an incident coordinator during an on-call rotation for any incidents detected via automated alerting workflows or reported to the security team through several channels. You must be someone who can debug complex problems and use methodical processes when troubleshooting a technical issue, including knowing when and how to work with team members, management, and other stakeholders in an effective and efficient manner. You must be an excellent communicator who can work with stakeholders to understand employee questions and potential concerns. You must provide strong stakeholder support and understand how and when to appropriately triage issues to completion and escalate potential issues appropriately. You are a tenacious and nimble learner who demonstrates design and engineering excellence. Being able to communicate security issues to employees in a non-technical manner is critical to success. The Team: The CSOC is a three-tiered structure responsible for ensuring the company's products and infrastructure are as secure as possible. The team works cross-functionally across the business with stakeholders to provide support, guidance, and technical implementations where appropriate, to include triage, containment, and remediation when applicable. Cross-functional teams in support of security threats or incidents include cyber threat intelligence, security engineering, public cloud security, risk management, and other security teams, but also dozens of technical teams in various environments. Job Responsibilities:

• Understand that as the Tier 3 (highest level) engineer, you're expected to handle potential incidents and act as the as a subject matter expert for all security-related tickets that come into the team's various queues (including triage, containment, and remediation when necessary).
• Receive incident escalations from Tier 1 and 2 analysts, assisting with real-time advanced analysis, response, and reporting.
• Mentor and assist in training Tier 1 and 2 analysts to aid in their skills development and analytical capabilities.
• Proactively hunt for threats and enacting identification, containment, and eradication measures while supporting recovery efforts.
• Serve as a point person for coordination with appropriate parties during a security incident - client, management, legal, security, operations, etc.
• Create thorough reports and documentation of all incidents and procedures, presenting findings to team and leadership on a routine basis.
• Incident Response: remote remediation when possible and working with onsite teams when necessary. Detailed documentation of events and remediation steps taken.
• Root Cause Analysis: initiation and follow-through to ensure quality forensic materials are captured, writing reports with details and timelines of events with recommendations to avoid future occurrences.
• Assist in the general maintenance and improvement of procedures, processes and playbooks.
• Conduct research regarding the latest methods, tools, and trends in digital forensics analysis.
• Conduct analysis using logs, previous alerts, etc. to identify trends to identify and prevent potential incidents.
• Follow standard operating procedures (SOPs) to ensure tickets are triaged appropriately and in a timely manner, according to SLAs.
• Excel at documentation and detailed notetaking, including SOP writing, incident reporting, e-mail and instant messaging etiquette, and most importantly, documenting incident actions in tickets. This role is responsible for completing incident reports and forensic reports, when appropriate, so competent writing skills are necessary.
• Ability to know when to appropriately escalate a potential issue to peers and/or leadership.
• Desire to learn new concepts and technologies to grow and take on more responsibility over time.
• Ability to communicate risk, prioritize incident response actions, and keep a cool head under pressure.
• Advanced experience with security tools like Splunk, CrowdStrike EDR, Carbon Black EDR, Proofpoint tools, Microsoft Defender components, Cyberhaven DLP, Axiom Cyber and open-source forensic tools, Cylance Protect, Office 365 tools, PowerShell, and various network tools, etc.
• Understanding the various stages of incident response, the importance and critical factors of an investigation, and how to contain as soon as possible.
• Have experience with the incident response lifecycle, the Lockheed Martin Cyber Kill Chain, the MITRE framework, and the forensic workflows as outlined by NIST.
• Work with deve

Apply tot his job Apply To this Job