Sr. Cybersecurity Incident Response Analyst (Application Analyst III) - Digital and Technology [...]

Mount Sinai Morningside; New York (NY); Remote; USD 100,000 - 130,000; Full time

Job summary

A leading healthcare organization is seeking a Sr. Cybersecurity Incident Response Analyst to join their Cybersecurity Operations team. This role focuses on detecting, analyzing, and responding to cybersecurity incidents, utilizing advanced security technologies and data analysis. The ideal candidate will have extensive experience in IT, incident response, and threat analysis, and will collaborate with various teams to enhance security measures. This position offers a unique opportunity to contribute to the organization's cybersecurity posture while working in a dynamic environment.

Qualifications

• Minimum five years of diverse IT experience.
• Experience managing security in cloud environments.

Responsibilities

• Respond to and triage cybersecurity incidents.
• Lead and participate in 'hunt campaigns' using threat intelligence.
• Analyze security incidents to improve detection operations.

Skills

Incident Response

Threat Analysis

Data Analysis

Communication

Education

Bachelor's degree in Computer Science

Advanced degree preferred

Tools

SIEM

SOAR

EDR technologies

Job description

Sr. Cybersecurity Incident Response Analyst (Application Analyst III) - Digital and Technology Partners - Remote

The Mount Sinai Cybersecurity Operations team seeks a highly motivated Sr. Cybersecurity Incident Response Analyst. This key team member will participate in incident response, threat investigations, threat campaigns, develop detection methodologies, and support the security monitoring team. The primary focus is to detect, analyze, and respond to cybersecurity incidents to minimize their impact, utilizing data analysis, threat intelligence, and advanced security technologies.

Responsibilities

• Respond to and triage cybersecurity incidents from 3rd party MDDR providers.
• Hunt for and identify threats, threat actor groups, and their techniques, tools, and processes.
• Lead and participate in 'hunt campaigns' using threat intelligence and log data analysis to detect and eliminate threat actors.
• Provide investigative support for large-scale and complex security incidents.
• Analyze security incidents to improve use cases and alert catalogs.
• Enhance processes for detection operations across multiple detection sets.
• Perform forensic analysis of network packets, DNS, proxy, Netflow, malware, host security, and application logs.
• Leverage the MITRE ATT&CK framework for analysis and detection improvements.
• Validate suspicious events using open-source and proprietary intelligence sources.
• Collaborate with teams to develop behavioral and signature detections using various machine learning techniques.
• Interface with internal teams to resolve issues and provide incident information.
• Become proficient with third-party threat intelligence tools as needed.

Qualifications

• Bachelor's degree in Computer Science or related field, or equivalent experience. Advanced degree preferred.
• Minimum five years of diverse IT experience.

Preferred Skills and Experience

• Experience with SIEM and SOAR platforms.
• Deep understanding of network and host intrusion analysis.
• Familiarity with frameworks like MITRE ATT&CK, STIX, TAXII, and the Cyber Kill Chain.
• Experience with EDR technologies (e.g., CrowdStrike, Carbon Black, Defender ATP, SentinelOne).
• Experience managing security in cloud environments (Azure, GCP, AWS).
• Reverse engineering, C&C exploitation, and system/network forensics experience.

Additional Preferred Skills

• Certifications such as GCIH, GCIA, GCFE, GREM, GCFA, GSEC, CEH.
• Experience with large data set normalization and parsing.
• Skills in statistical analysis, data modeling, clustering, and predictive analytics.
• Ability to translate security issues into analytical models and multitask effectively.
• Excellent communication skills.
• Knowledge of threat hunting tools and techniques.
• Experience in Red or Blue team operations.
• Passion for research and understanding internet threats.
• Ability to interface effectively with clients and document technical details clearly.