Cyber Security Specialist Lead

Franciscan Alliance, Inc.; Indianapolis (IN); Remote; USD 97,000 - 133,000; Full time

Job summary

Franciscan Alliance, Inc. is seeking a Cyber Security Specialist Lead to orchestrate security operations, threat hunting, and incident response. The role emphasizes advanced SPLUNK expertise, monitoring, and proactive defense across healthcare environments.

You will lead investigations, develop detections, and guide analysts through incident lifecycles while coordinating with security teams and external partners. Strong leadership and in-depth SIEM/SOAR skills are required.

Qualifications

• Degree requirements include an Associate's or Bachelor's degree; professional certificates preferred.
• 8 years Information Technology or Information Security experience.
• Healthcare industry security operations experience preferred; Essential Job Functions.
• Travel is required: Never or Rarely.
• Salary range provided for the Cyber Security Specialist Lead position.

Responsibilities

• Develop roadmaps and implementation plans for security technologies.
• Write and optimize SPL queries to identify and investigate suspicious activity; threat hunting across security data.
• Create, test, tune, and maintain high-fidelity detections; reduce false positives; use risk-based alerting; set thresholds and governance.
• Lead the SOC during investigation of high-severity incidents; guide analysts through the response lifecycle.
• Develop, maintain, and execute SOAR playbooks; automate enrichment and response tasks.
• Understand security data sources, data models, CIM; troubleshoot data quality issues; validate detections against reliable data.
• Serve as technical escalation point; coach analysts; establish investigation standards; communicate with SOC management.
• Build Splunk dashboards and reports to measure data sources, alert volume, and detection performance.
• Build detections for anomalous user and entity behavior; investigate compromised accounts and lateral movement.
• Work with internal resources and external 3rd parties to conduct penetration tests.
• Create and review cyber security policies, procedures, and standards related to SOC, Vulnerability Management, and Incident Response processes.

Skills

SPLUNK

SOC operations

Threat hunting

Incident response

Penetration testing

Education

Associate's Degree

Bachelor's Degree

Certificate

Tools

SIEM

SOAR

Job description

Work From HomeWork From Home Work From Home, Indiana 46544The Cyber Security Specialist Lead investigates and analyzes all response activities related to cyber incidents within the network environment or enclave. Collects data from a variety of Computer Network Defense (CND) tools, including intrusion detection system alerts, firewall and network traffic logs, and host system logs to analyze events that occur within their environment. Provides operations for persistent monitoring of all designated networks, enclaves, and systems. Interprets, analyzes, and reports all events and anomalies in accordance with computer network directives, including initiating, responding, and reporting discovered events. Acts as of the highest level of escalation point. Distributes directives, vulnerability, and threat advisories to identified consumers.

WHO WE ARE

With 11 ministries and access points across Indiana, Franciscan Health is one of the largest Catholic health care systems in the Midwest. Franciscan Health takes pride in hiring coworkers that provide compassionate, comprehensive care for our patients and the communities we serve.

SPLUNK CLOUD / ON PREMISE EXPERIENCE PREFERRED.

WHAT YOU CAN EXPECT

Work with Security Architects to develop roadmaps and implementation plans for upgrading, enhancing or replacing security technologies for which the Cyber Security Operations team is responsible. Demonstrate advanced proficiency to write and optimize complex SPL queries to identify and investigate suspicious activity, correlate events, identify attack patterns, and perform proactive threat hunting across security data. Create, test, tune, and maintain high-fidelity detections; reduce false positives; utilize risk-based alerting; and establish detection thresholds and governance. Stay abreast of current artificial intelligence capabilities of the SIEM and other deployed security tools, develop and implement these capabilities to improve SOC performance. Lead the SOC efforts during investigation of high‑severity security incidents, participate in the cyber security incident response team, and guide analysts through the incident response lifecycle. Develop, maintain, and safely execute SOAR playbooks; automate enrichment and response tasks; and identify opportunities to reduce repetitive analyst work. Understand security data sources, field extractions, data models, and the common information model (CIM), troubleshoot data quality issues, and validate detections are operating against reliable data. Serve as a technical escalation point, coach analysts, review investigations, establish investigation standards, and communicate clearly with SOC management and other security teams. Build Splunk dashboards and reports to measure data sources, alert volume, detection performance, investigation quality, and SOC effectiveness. Build detections for anomalous user and entity behavior, create procedures to investigate compromised accounts and lateral movement, use risk context to prioritize investigations. Work with internal resources and external 3rd parties to design and conduct penetration tests, including one designed as “stimulus‑response” for the centralized log management system. Create and review cyber security policies, procedures, and standards related to Security Operations Center, Vulnerability Management, and Incident Response processes.

QUALIFICATIONS

Required

Associate's DegreePreferred Bachelor's DegreePreferred Certificate8 years Information Technology or Information Security Department

Required5 years Healthcare industry; experience in security operations activities aligning with Essential Job Functions PreferredTRAVEL IS REQUIRED:Never or RarelyJOB RANGE:Cyber Security Specialist Lead - 96,731.58-133,005.92INCENTIVE:

EQUAL OPPORTUNITY EMPLOYER

It is the policy of Franciscan Alliance to provide equal employment to its employees and qualified applicants for employment as otherwise required by an applicable local, state or Federal law. Franciscan Alliance reserves a Right of Conscience objection in the event local, state or Federal ordinances that violate its values and the free exercise of its religious rights. Franciscan Alliance is committed to equal employment opportunity. Franciscan provides eligible employees with comprehensive benefit offerings. Find an overview on the benefit section of our career site,

jobs.franciscanhealth.org .