Security Threat Analyst

Harris Health System, Inc.; Houston (TX); On-site; USD 90,000 - 130,000; Full time

Job summary

Community Health Choice, Inc. in Houston, TX is seeking a Security Threat Analyst to identify and report cyber threats across systems, networks, cloud, identities, and data.

You will monitor threat intelligence, analyze security events, conduct threat hunting, support incident response, and translate findings into risk-based actions. This role collaborates with cybersecurity, infrastructure, compliance, and business teams to strengthen detection and reduce exposure in a regulated healthcare

Qualifications

• Bachelor's degree in cybersecurity or related field required.
• Master's degree preferred.
• Certifications such as Security+, CySA+, GSEC, CEH, CISSP are preferred.
• Experience in healthcare or regulated environments is preferred.

Responsibilities

• Monitor security alerts and threat intel across platforms.
• Analyze indicators of compromise and attacker tactics.
• Correlate data to determine threat scope, severity, and actions.
• Document findings, timelines, and remediation recommendations.
• Support incident response and escalation as needed.
• Coordinate with MSSP and internal teams on investigations.

Skills

Threat monitoring

Threat analysis

Incident triage

Security reporting

Education

Bachelor's degree in Cybersecurity, IT, CS, IS

Master's degree preferred

Tools

SIEM

EDR/XDR

Endpoint protection

Identity security

Cloud security

Email security

Vulnerability management

Job description

Community Health Choice, Inc. (Community) is a non-profit managed care organization (MCO), licensed by the Texas Department of Insurance. Through its network of more than 10,000 providers and 94 hospitals, Community serves over 400,000 Members with the following programs:

' Medicaid State of Texas Access Reform (STAR) program for low-income children and pregnant women

' Children's Health Insurance Program (CHIP) for the children of low-income parents, which includes CHIP Perinatal benefits for unborn children of pregnant women who do not qualify for Medicaid STAR

' Health Insurance Marketplace Plans that offer individual health coverage that includes preventive care, emergency services, prescription drugs, and hospitalization available to all, regardless of pre-existing conditions.

' Community Health Choice (HMO D-SNP), a Medicare Advantage Dual Special Needs plan for people with both Medicare and Medicaid that combines Medicare Part A and Part B benefits, Medicare Part D prescription drug coverage, and Medicaid benefits with additional health benefits like dental, vision, transportation, and more.

Improving Members' experiences is at the heart of every Community position. We strive every day to make sure that our Members have access to the high-quality health care they need and deserve.

Community is accredited by URAC for its health plan operations. We offer care management programs for asthma, diabetes, and high-risk pregnancy. An affiliate of the Harris Health System (Harris Health), Community is financially self-sufficient and receives no financial support from Harris Health or from Harris County taxpayers.

JOB SUMMARY:

The Security Threat Analyst is responsible for identifying, analyzing, prioritizing, and reporting cyber threats that may affect the organizations systems, data, networks, cloud environments, identities, and business operations. This individual contributor role supports the cybersecurity function by monitoring threat intelligence, analyzing security events, conducting threat hunting, supporting incident response, and translating technical findings into actionable risk-based recommendations.

The role requires applied experience in security operations, cyber threat analysis, incident triage, vulnerability and risk analysis, security monitoring tools, and regulated environment controls. The analyst collaborates with cybersecurity, infrastructure, application, compliance, and business partners to strengthen detection capability, reduce exposure to emerging threats, and support timely response to security events.

JOB SPECIFICATIONS AND CORE COMPETENCIES

Threat Monitoring, Analysis, and Triage

• Monitor security alerts, threat intelligence feeds, endpoint, identity, cloud, network, email, SIEM, EDR/XDR, IDS/IPS, and related security platforms to identify suspicious or malicious activity.
• Analyze indicators of compromise, indicators of attack, malware characteristics, phishing activity, adversary tactics, techniques, and procedures, and emerging cyber threat trends.
• Correlate data from multiple security sources to determine threat scope, severity, business impact, and recommended response actions.
• Document investigative findings, evidence, timelines, escalation rationale, and recommended remediation actions in accordance with cybersecurity procedures.

Incident Response and Security Operations Support

• Support incident response activities, including alert validation, containment coordination, eradication support, recovery follow-up, and post-incident lessons learned.
• Escalate confirmed or suspected threats to appropriate cybersecurity, infrastructure, application, compliance, or business stakeholders based on severity and established procedures.
• Maintain and update incident response procedures, threat analysis workflows, detection runbooks, and operating guidance.
• Coordinate with managed security service providers and internal technology teams to support timely investigation and resolution of security events.

Threat Hunting, Detection Improvement, and Vulnerability Context

• Conduct proactive threat hunting using endpoint, identity, network, cloud, and application telemetry to identify malicious activity that may bypass existing controls.
• Support tuning of detection logic, alert thresholds, queries, and use cases to improve security monitoring effectiveness and reduce false positives.
• Use vulnerability findings, threat intelligence, and asset criticality to help prioritize remediation recommendations and risk reduction activities.
• Support attack surface management, vulnerability validation, and remediation tracking in partnership with cybersecurity and technology teams.

Governance, Reporting, Compliance, and Awareness Support

• Prepare operational metrics, dashboards, and management reporting related to threat activity, security events, incident trends, and response effectiveness.
• Support HIPAA, HITRUST, NIST Cybersecurity Framework, audit, and evidence collection activities related to security monitoring and incident response controls.
• Assist with security awareness activities, phishing simulation follow-up, and communication of cyber threat trends to relevant stakeholders.
• Contribute to security policies, standards, procedures, and control documentation as assigned.

Other Duties as Assigned

QUALIFICATIONS:

Education/Specialized Training/Licensure: Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field required.

Master's degree in Cybersecurity, Information Systems, Information Technology, or related field preferred.

Relevant cybersecurity certifications preferred, such as:

• Security+
• CySA+
• GCIH, GCIA, GSEC, or related SANS certification
• CEH
• CISSP or associate-level CISSP
• Microsoft Security certification

Work Experience (Years and Area): 5 Years' Experience

• 3+ years of directly related cybersecurity experience.
• 2+ years of experience in security operations, threat analysis, incident response, vulnerability analysis, or cyber defense monitoring.
• Hands-on experience with SIEM, EDR/XDR, endpoint protection, identity security, cloud security, email security, vulnerability management, or related cybersecurity platforms.
• Experience analyzing security alerts, threat intelligence, indicators of compromise, and incident evidence.
• Experience in healthcare, health insurance, managed care, or other regulated technology environments preferred.
• Experience supporting HIPAA, HITRUST, NIST Cybersecurity Framework, or audit evidence activities preferred.

Management Experience (Years and Area): This is an individual contributor role with no direct people management responsibility.

Experience coordinating work across cybersecurity, infrastructure, application, compliance, vendor, or managed security service provider teams preferred.

Software Proficiencies:

• Threat analysis and security event investigation.
• Incident triage, evidence documentation, and escalation judgment.
• Knowledge of security monitoring tools, SIEM, EDR/XDR, endpoint, identity, cloud, and network security controls.
• Analytical thinking, problem analysis, accuracy, and attention to detail.
• Written and verbal communication for technical and non-technical audiences.
• Ability to work independently and collaboratively in a time-sensitive security operations environment.

Other:

• Ability to support managed security service provider coordination.
• Ability to communicate cyber threat findings, risks, and recommendations clearly.

Strong business judgment and discretion when handling sensitive security information.