Level I - Security Threat Engineer

HCA Healthcare; India; On-site; INR 1,500,000 - 2,500,000; Full time

Benefits offered by this job

Health insurance

Paid time off

Professional development

Job summary

HCA Healthcare is seeking an experienced Cyber Incident Response professional to bolster our 24/7 CDC team. The role provides Tier 1/2 analysis and response to cyber threats, coordinating with field resources and enterprise teams to detect, respond, and eradicate threats.

The candidate will participate in incident handling, root-cause analysis, and ongoing improvement of SOC processes, with a focus on CI/CD security and threat intelligence.

Qualifications

• Bachelor's degree in IT or a related field is required.
• 2+ years of team leadership or people-management experience is required.
• Strong knowledge of cybersecurity capabilities across OSI layers, networks, cloud, and CI/CD platforms.

Responsibilities

• Monitor security alert queue, investigate and triage events; coordinate with CyberSecurity teams to remediate threats.
• Execute Incident Response plan; act as Incident Commander or Task Lead during incidents as needed.
• Provide guidance to field resources on proper threat remediation and improve detection tooling and playbooks.
• Collaborate with CDC and Cyber Engineering teams to improve tools, techniques, and procedures.
• Document root causes and lessons learned; participate in red/blue team exercises.

Skills

Cyber Incident Response

Splunk

EDR

SOAR

Netflow analysis

Malware repositories

Education

Bachelor's degree in IT or related field

2+ years leadership experience

Tools

SIEM tools

Forensic tools

Job description

PositionSummary:

The GCN 1 – serving as direct support to the HCACDC corporate team – is a critical member of the 24/7 CDC team. They will usestate of the art technologies to detect threats on our network and eradicatethem as a member of our Cyber Defense Center (CDC). As a member of the CDC,they will operate along with a small team of like-minded individuals with apassion for cyber security.

This role will provide Tier 1 and Tier 2 analysisand response to cyber security threats. Threat Response Engineers will beexpected to detect malicious activity and support the business through theIncident Response process for both routine and major events. Successfulcandidates will have a passion for cybersecurity and be naturally curious andself-motivated to investigate and discover root causes of events whileworking in a fast-paced and sometimes stressful environment. Good teamwork and communication skills arealso vital. Our team operates as a close-knit group serving a noble purpose –to win the fight against evil every day.

Responsibilities

• Monitor security alert queue – investigate andtriage events based on criticality.Work directly with HCA field resources and other members of CyberSecurity to remediate threats.
• Use analytic techniques and critical thinking todetermine if and when to escape threats to larger Cyber Security team.
• Provide guidance to field resources on how toproperly remediate a threat.
• Work closely with other CDC team members andmembers of Cyber Engineering teams to improve tools, techniques, andprocedures for CDC operation.
• Provide feedback to detection engineering teams onalert fidelity to recommend alert tuning when needed
• Continuously improve documentation of workproducts and processes.
• Participate in red/blue team exercises.
• Execute HCA’s Incident Response plan as part of anincident response team. Serve asIncident Commander, Task Lead, or Scribe during incidents when needed,
• Routinely collaborate with individuals and teamsfrom across the enterprise, both inside and outside Cyber.

Desired Experience

• Experience as a member of a Cyber IncidentResponse Team (CIRT) or comparable team.
• Experience executing an Incident Response plan,preferably based on recognized industry standards (e.g. – NIST, SANS, etc).
• Experience in Windows Artifact Analysis andInitial Forensic Analysis (e.g. – Program Execution, File/Folder opening,Account Usage, pulling memory, following proper evidence handling procedures,etc) using industry standard tools and available logs (e.g. – EndpointDetection and Response (EDR) tools).
• Experience in network forensic analysis todetermine validity of detected events using available network logs collectedvia SEIM.
• Experience triaging cloud security threats(malicious workloads, unauthorized cloud access, virtualization-basedthreats)
• Experience responding to CI/CD based threats(unauthorized access, data exfiltration, etc.)
• Experience in evidence collection for later DFIR(Digital Forensics Incident Response).
• Experience with an event/information analysisframework such as Analysis of Competing Hypotheses (ACH).
• Experience in performing security analysis orreporting utilizing Security Incident and Event Management (SIEM)Technologies. Preferably Splunk and SPL experience.
• Experience with document management and sustainingSecurity Operations Center (SOC) policies and run book procedures forincident response.
• Experience with documenting root cause analysisand lessons learned.
• Experience consuming and generating cybersecuritythreat intelligence.
• Experience across the technology stack. Familiarity with all OSI layers andexpertise in some.
• Experiencing using the following types of securitytools:
  • SIEM
  • Firewalls
  • Web Proxy
  • Anti-Virus (AV)
  • Endpoint Detection and Response (EDR)
  • Sandboxing
  • Virtual Machines
  • Netflow analysis
  • Malware Repositories
  • Deception Stack

Education& Experience:

The successful candidate will possess thefollowing aptitudes and skillsets:

• Bachelor's degree in IT or any other relevantfield
• 2+ years with team leadership or people-managementexperience.
• Able to maintain a superior knowledge of the cybersecurity capabilities of operating systems, networking devices, controlsystems, cloud platforms, CI/CD platforms, and vendor offerings viaself-directed learning and formal training.
• Excellent critical thinking skills to understandavailable data and use it to support or refute potential hypothesis thatexplain the data. Use available data to develop and communication conclusionsand recommendations.
• An ability to work and thrive in stressfulsituations. A demeanor that conveys calm professionalism in stressfulsituations.
• An ability to maintain confidentiality ofsensitive data and to follow proper ethical practices for using tools and accessing data.
• A strong desire to determine root cause of events.A willingness to fully investigate all alternatives exhaustively until aconclusion can be supported.
• Ability to self-prioritize tasks based oncriticality and threat level.
• Advanced written and oral communicationskills.
• GIAC: GSEC, GCIH, GCIA, GCED, GMON, GCDA, GDAT,GCFE or comparable

Must Have Skills

• Security Operations Center (Incident response)
• SIEM Tool: Splunk
• Automation: SOAR
• Endpoint Detection and Response (EDR)
• Sandboxing
• Virtual Machines
• Net flow analysis
• Malware Repositories

Good To Have Skills

• Vulnerability Assessment and Penetration Testing

Licenses, Certifications & Training:

The following certifications and courses arehelpful, but, not required:

• Certified Ethical Hacker (CEH)
• GIAC: GSEC, GCIH, GCIA, GCED, GMON, GCDA, GDAT,GCFE or comparable
• CompTIA Security+

Knowledge,Skills, Abilities, Behaviors:

Extensive periods of sitting or standing at workstationto include use of mouse, keyboard, and monitor(s).