Incident Response Analyst, I

This is a fully remote position, open to applicants in Missouri.

📋 Description

• Conduct investigations into security incidents and suggest improvements for security measures.

• Recognize common attack patterns aimed at externally-facing assets.

• Assist in implementing the enterprise Incident Response Plan.

• Facilitate enterprise-wide remediation initiatives organized by DFIR.

• Contribute to briefings and reports for leadership.

• Triage and examine security alerts, events, and notifications across endpoints, email, identity, and network telemetry.

• Escalate confirmed or suspected incidents to DFIR based on established criteria.

• Analyze phishing attempts and malicious emails to ascertain their disposition.

• Document investigation procedures, findings, and outcomes in the case management system.

• Carry out authorized containment actions, including IOC blocking and host isolation.

• Identify opportunities for detection tuning and automation.

• Assist in reviewing security configurations on production information systems and networks.

• Aid in the prevention and resolution of security breaches.

• Support access authorization reviews and validation of access controls.

• Contribute to the development of automated scripts, response playbooks, and programmed responses.

• Collaborate with Information Security Architects, Engineers, and stakeholders from software or hardware domains.

• Integrate third-party attack monitoring and threat reporting services into internal CIRT communication systems.

• Perform additional duties as assigned and adhere to policies and standards.

⛳️ Requirements

• Must have authorization to work in the U.S. without sponsorship for employment-based visas, now or in the future.

• A Bachelor's degree in a quantitative or business discipline (e.g., statistics, mathematics, engineering, computer science) with 0–2 years of pertinent experience, or equivalent experience, or completion of a Centene-sponsored emerging talent program.

• Knowledge of networking fundamentals, including TCP/IP, DNS, HTTP, routers, switches, and firewalls.

• Understanding of Windows and Linux operating system fundamentals.

• Experience in log analysis and the investigation of security incidents.

• Familiarity with indicators of compromise (IOCs) and the tactics, techniques, and procedures (TTPs) used by threat actors.

• Preferred hands-on experience with EDR tools such as CrowdStrike or Microsoft Defender for Endpoint.

• Preferred hands-on experience with SIEM platforms and query languages such as Splunk SPL, KQL, or SQL.

• Familiarity with email security solutions like Proofpoint and phishing analysis techniques.

• Understanding of the MITRE ATT&CK framework.

• Basic scripting skills in PowerShell or Python.

• CompTIA Security+, Microsoft SC-200, AWS Certified Cloud Practitioner, or ISC2 CC are preferred but not mandatory.

🏝️ Benefits

• Competitive salary.

• Health insurance coverage.

• 401K retirement plan.

• Stock purchase plans.

• Tuition reimbursement program.

• Paid time off in addition to holidays.

• Flexible work arrangements, including remote, hybrid, field, or office schedules.

• Additional incentive options may be included in total compensation.

• Equal opportunity employer dedicated to diversity.