Incident Response Analyst

Ardent Health Services; Brentwood (TN); On-site; USD 85,000 - 110,000; Full time

Job summary

Ardent Health Services in Brentwood, TN is seeking an Information Security Analyst – Incident Response to join a proactive security team. You will monitor incidents, follow playbooks, and support the organization in detecting and responding to cyber threats while maintaining patient care priorities.

The role requires knowledge of Windows/Linux forensics, scripting and security tooling, plus the ability to communicate findings clearly to IT and business units.

Qualifications

• Associates degree or equivalent cybersecurity training/experience.
• Knowledge of Windows/Linux forensics, scripting, and SQL.
• Familiarity with cyber kill chain, MITRE ATT&CK/D3FEND, NIST standards.
• Experience with security platforms (SIEM/EDR, email security gateway).
• Ability to work under pressure and communicate clearly.
• On-call availability and occasional travel.

Responsibilities

• Monitors and acts on security incidents.
• Follows incident response processes, procedures, and playbooks.
• Participates in tabletop exercises / training.
• Contributes to incident reports and maintains incident logs.
• Builds /Maintains an incident response toolkit.
• Researches and recommends solutions meeting security standards.
• Assists in disaster recovery and contingency planning.
• Works with Threat and Vulnerability team using purple team processes.

Skills

Incident response

Windows forensics

Linux forensics

Powershell

Bash

Python

SQL

Active Directory

Networking protocols

MITRE ATT&CK

Education

Associate degree

Tools

SIEM

EDR

Email security gateway

Intrusion detection systems

Job description

Overview

Ardent Health is a leading provider of healthcare in communities across the country. With a focus on consumer-friendly processes and investments in innovative services and technologies, Ardent is passionate about making healthcare better and easier to access. We are driven by our purpose of caring for people: our patients, our communities and one another.

Located in Brentwood, Tennessee, Ardent has earned a reputation as one of the industry’s strongest and most innovative healthcare systems. Our facilities and clinics are consistently recognized among healthcare’s best employers. We recognize each hospital and clinic is as unique as the community it serves. We strive to maintain strong community ties through advisory boards, contributions, charitable care, education and outreach.

Ardent includes:

• 30 hospitals
• 280 sites of care
• 4,281 beds
• 24,000+ team members
• 8,200+ nurses
• 1,800+ aligned providers
• 5.8M annual provider encounters
• 421 medical residents

Ardent makes considerable investments in people, technology, facilities, and communities, producing high quality care and extraordinary results. From newly constructed facilities and expanded services, to lifesaving technology and outstanding opportunities for employees, Ardent is committed to providing its hospitals and clinics the tools needed to succeed.

We believe it is this mix of corporate support and local autonomy that equips our teams for success.

Job Overview

The Information Security Analyst – Incident Response responds to cyber-attacks, network intrusions, and computer crimes. Incident response analyst contributes to all aspects of the incident response from initiation to conclusion. Additionally, the IR analyst performs all activities occurring during the incident following policy, procedures, and established methodologies. Participates in root cause analysis for each event and helps to define follow-up action items including recommendations. A successful candidate in this role strives to enforce Information security best practices, policies, standards, and guidance to ensure the safeguard of proprietary data, physical infrastructure and resources from internal and external threats.

Responsibilities

• Monitors and acts on security incidents.
• Follows incident response processes, procedures, and playbooks.
• Participates in tabletop exercises / training.
• Contributes to incident reports and maintain incident logs.
• Builds /Maintains an incident response toolkit.
• Research and recommend solutions that meet security standards while ensuring functionality for business continuity.
• Assists in development of disaster recovery and contingency plans.
• Works closely with Threat and Vulnerability team using purple team process, procedures and exercises.

Qualifications

Job Requirements

• Associates degree or equivalent cybersecurity training/experience.
• Knowledge of: Windows/Linux forensics, regular expressions, Powershell, Bash, Javascript, Python, SQL, Active Directory, networking protocols/flow, authentication and authorization protocols
• Familiarity of: cyber kill chain, MITRE ATT&CK/D3FEND, NIST SP 800-61, NIST SP 800-53 ISO 27001.
• Previous security platform experience (SIEM, EDR, email security gateway, etc.)
• Knowledge of common and emerging attack vectors, penetration methods, countermeasures, and remediation methods.
• Prioritize tasks effectively to meet project deadlines and deliverables.
• Passion for cybersecurity, problem solving and learning.
• Excellent written and oral communication skills
• Experienced in assessing and/or administering intrusion detection/prevention.
• ITIL familiarization or experience - managing incidents, requests, and changes.
• Skills Including:
• Solving complex problems with information technology.
• Ability to handle stressful situations.
• Ability to collaborate with IT and business departments to identify, contain, eradicate, and recover.
• Ability to balance the seriousness of protecting electronic information assets with the need to enable users to effectively and efficiently use systems to perform job responsibilities, while continuing to emphasize quality patient care.
• Strong customer service focus and ability to manage client (e.g., facility) expectations.
• Excellent oral and written communication skills with the ability to present and discuss technical information in a manner suitable for the audience.
• Must be willing to travel occasionally.
• Must be willing to respond to security issues 24x7 (on call).

Job Preferred Requirements

• SOC, IR, threat hunt or sysadmin training/experience.
• CTF and/or training tools (HTB) participation.
• DoD 8570 IAT II or higher compliant certifications or reputable security certifications. Examples include: GCIH, GCIA, CEH, GSEC, GCFA, GCFE, Sec+, CySA+, CCNA Sec, CCNA Cyber, blue team certifications, Microsoft certifications and other equivalents.