Incident Response Analyst

Ardent Health; Brentwood (TN); On-site; USD 90,000 - 120,000; Full time

Job summary

Ardent Health in Brentwood, TN is seeking an Information Security Analyst – Incident Response to defend against cyber-attacks and intrusions. The role handles incident response from initiation to closure, enforcing security policies to protect patient data and infrastructure.

You will monitor security events, follow playbooks, participate in drills, contribute to reports, and help build tools for incident response.

Qualifications

• Associates degree or equivalent cybersecurity training/experience.
• Knowledge of Windows/Linux forensics, regex, Powershell, Bash, Javascript, Python, SQL, AD, networking protocols.
• Familiarity with MITRE ATT&CK, NIST SP 800-61/800-53, ISO 27001.
• Experience with security platforms (SIEM, EDR, email security gateway).
• Knowledge of attack vectors, remediation methods, and incident handling.
• ITIL familiarity; ability to manage incidents, requests and changes.
• Excellent problem solving and collaboration with IT and business teams.

Responsibilities

• Monitors and acts on security incidents.
• Follows incident response processes, procedures, and playbooks.
• Participates in tabletop exercises / training.
• Contributes to incident reports and maintain incident logs.
• Builds /Maintains an incident response toolkit.
• Research and recommend solutions that meet security standards while ensuring functionality for business continuity.
• Assists in development of disaster recovery and contingency plans.
• Works closely with Threat and Vulnerability team using purple team process, procedures and exercises.

Skills

Windows/Linux forensics

Regular expressions

Cybersecurity knowledge

MITRE ATT&CK familiarity

SIEM experience

EDR experience

Incident response

ITIL familiarity

Problem solving

Team collaboration

Education

Associates degree or equivalent cybersecurity training/experience

Tools

SIEM

EDR

Email security gateway

Job description

Overview

Ardent Health is a leading provider of healthcare in communities across the country. With a focus on consumer-friendly processes and investments in innovative services and technologies, Ardent is passionate about making healthcare better and easier to access. We are driven by our purpose of caring for people: our patients, our communities and one another.Located in Brentwood, Tennessee, Ardent has earned a reputation as one of the industry’s strongest and most innovative healthcare systems. Our facilities and clinics are consistently recognized among healthcare’s best employers. We recognize each hospital and clinic is as unique as the community it serves. We strive to maintain strong community ties through advisory boards, contributions, charitable care, education and outreach.Ardent includes:

• 30 hospitals
• 280 sites of care
• 4,281 beds
• 24,000+ team members
• 8,200+ nurses
• 1,800+ aligned providers
• 5.8M annual provider encounters
• 421 medical residents

Ardent makes considerable investments in people, technology, facilities, and communities, producing high quality care and extraordinary results. From newly constructed facilities and expanded services, to lifesaving technology and outstanding opportunities for employees, Ardent is committed to providing its hospitals and clinics the tools needed to succeed.We believe it is this mix of corporate support and local autonomy that equips our teams for success.

Job Overview:

The Information Security Analyst – Incident Response responds to cyber-attacks, network intrusions, and computer crimes. Incident response analyst contributes to all aspects of the incident response from initiation to conclusion. Additionally, the IR analyst performs all activities occurring during the incident following policy, procedures, and established methodologies. Participates in root cause analysis for each event and helps to define follow-up action items including recommendations. A successful candidate in this role strives to enforce Information security best practices, policies, standards, and guidance to ensure the safeguard of proprietary data, physical infrastructure and resources from internal and external threats.

Responsibilities

• Monitors and acts on security incidents.
• Follows incident response processes, procedures, and playbooks.
• Participates in tabletop exercises / training.
• Contributes to incident reports and maintain incident logs.
• Builds /Maintains an incident response toolkit.
• Research and recommend solutions that meet security standards while ensuring functionality for business continuity.
• Assists in development of disaster recovery and contingency plans.
• Works closely with Threat and Vulnerability team using purple team process, procedures and exercises.

Qualifications

Job Requirements:

• Associates degree or equivalent cybersecurity training/experience.
• Knowledge of: Windows/Linux forensics, regular expressions, Powershell, Bash, Javascript, Python, SQL, Active Directory, networking protocols/flow, authentication and authorization protocols
• Familiarity of: cyber kill chain, MITRE ATT&CK/D3FEND, NIST SP 800-61, NIST SP 800-53 ISO 27001.
• Previous security platform experience (SIEM, EDR, email security gateway, etc.)
• Knowledge of common and emerging attack vectors, penetration methods, countermeasures, and remediation methods.
• Prioritize tasks effectively to meet project deadlines and deliverables.
• Passion for cybersecurity, problem solving and learning.
• Excellent written and oral communication skills
• Experienced in assessing and/or administering intrusion detection/prevention.
• ITIL familiarization or experience - managing incidents, requests, and changes.
• Skills Including:
• Solving complex problems with information technology.
• Ability to handle stressful situations.
• Ability to collaborate with IT and business departments to identify, contain, eradicate, and recover.
• Ability to balance the seriousness of protecting electronic information assets with the need to enable users to effectively and efficiently use systems to perform job responsibilities, while continuing to emphasize quality patient care.
• Strong customer service focus and ability to manage client (e.g., facility) expectations.
• Excellent oral and written communication skills with the ability to present and discuss technical information in a manner suitable for the audience.
• Must be willing to travel occasionally.
• Must be willing to respond to security issues 24x7 (on call).

Job Preferred Requirements:

• SOC, IR, threat hunt or sysadmin training/experience.
• CTF and/or training tools (HTB) participation.
• DoD 8570 IAT II or higher compliant certifications or reputable security certifications. Examples include: GCIH, GCIA, CEH, GSEC, GCFA, GCFE, Sec+, CySA+, CCNA Sec, CCNA Cyber, blue team certifications, Microsoft certifications and other equivalents.