Lead Cyber Security Specialist

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct investigations and analyses of cyber incident response activities within network environments or enclaves.

• Gather and assess data from CND tools, intrusion detection notifications, firewall and network traffic logs, as well as host system logs.

• Ensure continuous monitoring of specified networks, enclaves, and systems.

• Interpret, analyze, and report events and anomalies in line with computer network directives.

• Serve as the primary escalation point for complex issues.

• Distribute directives, vulnerability advisories, and threat advisories to designated recipients.

• Collaborate with Security Architects on roadmaps and implementation strategies for security technologies.

• Lead SOC initiatives during high-severity security incident investigations and guide analysts through the incident response lifecycle.

• Create, maintain, and securely execute SOAR playbooks; automate enrichment and response tasks.

• Resolve security data quality issues and confirm detections against trustworthy data.

• Mentor analysts, review investigations, set investigation standards, and liaise with SOC management and security teams.

• Develop Splunk dashboards and reports that evaluate data sources, alert volume, detection performance, investigation quality, and SOC efficiency.

• Formulate procedures for investigating compromised accounts and lateral movement.

• Collaborate with internal teams and external partners to design and conduct penetration tests.

• Draft and review cybersecurity policies, procedures, and standards for SOC, Vulnerability Management, and Incident Response.

⛳️ Requirements

• An Associate's Degree is required.

• A minimum of 8 years of experience in Information Technology or Information Security Department is required.

• A Bachelor's Degree is preferred.

• A relevant certificate is preferred.

• At least 5 years of experience in the healthcare industry; experience in security operations activities aligning with Essential Job Functions is preferred.

• Experience with Splunk Cloud or on-premise is preferred.

• Advanced skills in writing and optimizing complex SPL queries are essential.

• Proven experience in creating, testing, tuning, and maintaining high-fidelity detections.

• Familiarity with risk-based alerting and detection thresholds/governance is required.

• Knowledge of SIEM artificial intelligence capabilities is necessary.

• Experience in high-severity security incident investigation and incident response is critical.

• Experience in developing and executing SOAR playbooks is required.

• Understanding of security data sources, field extractions, data models, and CIM is needed.

• Experience in building Splunk dashboards and reports is essential.

• Experience in creating anomalous user and entity behavior detections is required.

• Experience in conducting penetration tests is necessary.

• Knowledge of cybersecurity policies, procedures, and standards is essential.

🏝️ Benefits

• Comprehensive benefit offerings available for eligible employees.

• Travel is seldom or rarely required.