Incident Response Analyst: Cyber Defense & Forensics

Ardent Health Services; Brentwood (TN); On-site; USD 85,000 - 110,000; Full time

Job summary

Ardent Health Services in Brentwood, TN is seeking an Information Security Analyst – Incident Response to join a proactive security team. You will monitor incidents, follow playbooks, and support the organization in detecting and responding to cyber threats while maintaining patient care priorities.

The role requires knowledge of Windows/Linux forensics, scripting and security tooling, plus the ability to communicate findings clearly to IT and business units.

Qualifications

• Associates degree or equivalent cybersecurity training/experience.
• Knowledge of Windows/Linux forensics, scripting, and SQL.
• Familiarity with cyber kill chain, MITRE ATT&CK/D3FEND, NIST standards.
• Experience with security platforms (SIEM/EDR, email security gateway).
• Ability to work under pressure and communicate clearly.
• On-call availability and occasional travel.

Responsibilities

• Monitors and acts on security incidents.
• Follows incident response processes, procedures, and playbooks.
• Participates in tabletop exercises / training.
• Contributes to incident reports and maintains incident logs.
• Builds /Maintains an incident response toolkit.
• Researches and recommends solutions meeting security standards.
• Assists in disaster recovery and contingency planning.
• Works with Threat and Vulnerability team using purple team processes.

Skills

Incident response

Windows forensics

Linux forensics

Powershell

Bash

Python

SQL

Active Directory

Networking protocols

MITRE ATT&CK

Education

Associate degree

Tools

SIEM

EDR

Email security gateway

Intrusion detection systems

Job description

Ardent Health Services in Brentwood, TN is seeking an Information Security Analyst – Incident Response to join a proactive security team. You will monitor incidents, follow playbooks, and support the organization in detecting and responding to cyber threats while maintaining patient care priorities.

The role requires knowledge of Windows/Linux forensics, scripting and security tooling, plus the ability to communicate findings clearly to IT and business units.