Senior Cyber Defense Lead: Incident Response

HCA Healthcare; Nashville (TN); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Comprehensive benefits

Wellbeing support

Paid time off

401(k) match

Tuition assistance

Job summary

HCA Healthcare in Nashville seeks a Senior Security Threat Engineer to act as the Cyber Defender, monitoring threats, performing incident response, and guiding investigations across the enterprise. You will lead Major Incident Response efforts and coordinate with the CDC to enhance detection and response capabilities.

The role requires expertise across SIEM, EDR, memory and network forensics, and threat intelligence, with a track record of handling high‑tempo security events and leading incident

Qualifications

• 5+ years in cybersecurity incident response or CIRT.
• Experience executing incident response plans per industry standards (NIST, SANS).
• Proficient in Windows artifact and memory analysis using standard tools (EDR, Volatility).
• Strong problem-solving, leadership, and communication skills.

Responsibilities

• Monitor security alert queue, triage events, and recommend mitigations.
• Lead Major Incident Response efforts and advise the business.
• Guide field resources on threat remediation.
• Collaborate with CDC to improve tools, techniques, and runbooks.
• Document processes and outcomes, and participate in red/blue exercises.
• Serve as SME across Cyber Defense Center domains.

Skills

Cyber threat analysis

Incident response

Leadership in IR

Team collaboration

Education

Bachelor’s Degree Preferred

Tools

SIEM

Firewalls

Web Proxy

AV/NGAV

EDR

Sandboxing

Virtual Machines

Netflow analysis

Threat Intelligence

Deception Stack

IDS/IPS

SOAR

Phishing Triage

UBA

Email Hygiene

ServiceNow

JIRA

Threat Modeling

Job description

HCA Healthcare in Nashville seeks a Senior Security Threat Engineer to act as the Cyber Defender, monitoring threats, performing incident response, and guiding investigations across the enterprise. You will lead Major Incident Response efforts and coordinate with the CDC to enhance detection and response capabilities.

The role requires expertise across SIEM, EDR, memory and network forensics, and threat intelligence, with a track record of handling high‑tempo security events and leading incident