Cyber Security Specialist Lead

Franciscan Alliance, Inc.; Indiana; Remote; USD 97,000 - 133,000; Full time

Job summary

Franciscan Alliance is seeking a Cyber Security Specialist Lead to oversee cyber incident response, threat hunting, and SIEM operations. The role emphasizes hands-on detection development, SOC leadership during incidents, and collaboration with security teams across the healthcare environment.

The position favors Splunk experience, SOAR playbook creation, and a background in healthcare IT security, with a flexible work arrangement in Indiana.

Qualifications

• Associate's Degree required.
• Bachelor's Degree preferred.
• Certificate preferred.
• 8 years Information Technology or Information Security experience required.
• 5 years Healthcare security operations experience preferred.

Responsibilities

• Monitor and investigate cyber incidents in the network environment.
• Write SPL queries to detect threats and hunt for anomalies.
• Develop detections, reduce false positives, and tune alerts.
• Lead SOC during high-severity incidents and coordinate response.
• Develop and execute SOAR playbooks for automated responses.
• Collaborate with internal and external teams for tests and policy reviews.

Skills

Splunk experience

Incident response

SOC operations

Threat hunting

Education

Associate's Degree

Bachelor's Degree

Certificate

Tools

Splunk

SIEM

Job description

Work From HomeWork From Home Work From Home, Indiana 46544

The Cyber Security Specialist Lead investigates and analyzes all response activities related to cyber incidents within the network environment or enclave. Collects data from a variety of Computer Network Defense (CND) tools, including intrusion detection system alerts, firewall and network traffic logs, and host system logs to analyze events that occur within their environment. Provides operations for persistent monitoring of all designated networks, enclaves, and systems. Interprets, analyzes, and reports all events and anomalies in accordance with computer network directives, including initiating, responding, and reporting discovered events. Acts as of the highest level of escalation point. Distributes directives, vulnerability, and threat advisories to identified consumers.

WHO WE ARE

With 11 ministries and access points across Indiana, Franciscan Health is one of the largest Catholic health care systems in the Midwest. Franciscan Health takes pride in hiring coworkers that provide compassionate, comprehensive care for our patients and the communities we serve.

SPLUNK CLOUD / ON PREMISE EXPERIENCE PREFERRED.

WHAT YOU CANNOT EXPECT

• Work with Security Architects to develop roadmaps and implementation plans for upgrading, enhancing or replacing security technologies for which the Cyber Security Operations team is responsible.
• Demonstrate advanced proficiency to write and optimize complex SPL queries to identify and investigate suspicious activity, correlate events, identify attack patterns, and perform proactive threat hunting across security data.
• Create, test, tune, and maintain high-fidelity detections; reduce false positives; utilize risk-based alerting; and establish detection thresholds and governance.
• Stay abreast of current artificial intelligence capabilities of the SIEM and other deployed security tools, develop and implement these capabilities to improve SOC performance.
• Lead the SOC efforts during investigation of high-severity security incidents, participate in the cyber security incident response team, and guide analysts through the incident response lifecycle.
• Develop, maintain, and safely execute SOAR playbooks; automate enrichment and response tasks; and identify opportunities to reduce repetitive analyst work.
• Understand security data sources, field extractions, data models, and the common information model (CIM), troubleshoot data quality issues, and validate detections are operating against reliable data.
• Serve as a technical escalation point, coach analysts, review investigations, establish investigation standards, and communicate clearly with SOC management and other security teams.
• Build Splunk dashboards and reports to measure data sources, alert volume, detection performance, investigation quality, and SOC effectiveness.
• Build detections for anomalous user and entity behavior, create procedures to investigate compromised accounts and lateral movement, use risk context to prioritize investigations.
• Work with internal resources and external 3rd parties to design and conduct penetration tests, including ones designed as “stimulus-response” for the centralized log management system.
• Create and review cyber security policies, procedures, and standards related to Security Operations Center, Vulnerability Management, and Incident Response processes.

QUALIFICATIONS

• Required Associate's Degree
• Preferred Bachelor's Degree
• Preferred Certificate
• 8 years Information Technology or Information Security Department Required
• 5 years Healthcare industry; experience in security operations activities aligning with Essential Job Functions Preferred

TRAVEL IS REQUIRED:

Never or Rarely

JOB RANGE:Cyber Security Specialist Lead - 96,731.58-133,005.92INCENTIVE:

EQUAL OPPORTUNITY EMPLOYER

It is the policy of Franciscan Alliance to provide equal employment to its employees and qualified applicants for employment as otherwise required by an applicable local, state or Federal law.

Franciscan Alliance reserves a Right of Conscience objection in the event local, state or Federal ordinances that violate its values and the free exercise of its religious rights.

Franciscan Alliance is committed to equal employment opportunity.

Franciscan provides eligible employees with comprehensive benefit offerings. Find an overview on the benefit section of our career site, jobs.franciscanhealth.org .