Description

SHIFT: Mixed (rotating weekends)
SCHEDULE: Full-time

HCA Healthcare ITG

Please click the link above to Watch our Identity Video to get a closer look at who we are and what we do!

Do you want to be a part of a family and not just another employee? Are you looking for a work environment where diversity and inclusion thrive? Submit your application today and find out what it truly means to be a part of a team.

You contribute to our success. Every role has an impact on our patients’ lives and you have the opportunity to make a difference. We are looking for dedicated professional like you to be a part of our team. Join us in our efforts to better our community!

At HCA Healthcare, you have options. You can choose from a variety of benefits to create a customizable plan. You have the ability to enroll in several medical coverage plans including vision and dental. You can even select additional al la carte benefits to meet all your needs. Enroll in our Employee Stock Purchase Plan (ESPP), 401k, flex spending accounts for medical and childcare needs, and participate in our tuition assistance program.

Job Summary:
You will be a Cyber Defender – serving as the last line of defense between HCA and the threat actors that wish to bring harm to HCA and the patients we serve. You will use state of the art technologies to detect threats on our network and eradicate them as a member of our CyberDefense Center (CDC). As a member of the CDC, you will operate along with a small team of like-minded individuals with a passion for cyber security.

This role will provide Tier 1 and Tier 2 analysis and response to cyber security threats. Threat Response Engineers will be expected to detect malicious activity and support the business through the Incident Response process for both routine and major events. Successful candidates will have a passion for cybersecurity and be naturally curious and self-motivated to investigate and discover root cause of events while working in a fast-paced and sometimes stressful environment. Good teamwork and communication skills are also vital. Our team operates as a close knit group serving a noble purpose – to win the fight against evil every day.

General Responsibilities:

Monitor security alert queue – investigate and triage events based on criticality. Provide recommendations on how to mitigate the threats. Use analytic techniques and critical thinking to determine if and when to escalate threats to larger Cyber Security team.
Provide guidance to field resources on how to properly remediate a threat.
Work closely with other CDC team members to improve tools, techniques, and procedures for CDC operation.
Continuously improve documentation of work products and processes.
Participate in red/blue team exercises.
Execute HCA’s Incident Response plan as part of an incident response team. Serve as Incident Commander, Task Lead, or Scribe during incidents.
Routinely collaborate with individuals and teams from across the enterprise.

Desired Experience:

Experience as a member of a Cyber Incident Response Team (CIRT) or comparable
Experience executing an Incident Response plan, preferably based on recognized industry standards (e.g. – NIST, SANS, etc)
Experience in Windows Artifact Analysis and Initial Forensic Analysis (e.g. – Program Execution, File/Folder opening, Account Usage, pulling memory, following proper evidence handling procedures, etc) using industry standard tools and available logs (e.g. – Endpoint Detection and Response (EDR) tools such as Netwitness Endpoint).
Experience in Memory Analysis using tools such as Volatility
Experience in network forensic analysis to determine validity of detected events using available network logs collected via SEIM.
Experience in DFIR (Digital Forensics Incident Response)
Experience with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH).
Experience in performing security analysis or reporting utilizing Security Incident and Event Management (SIEM) Technologies. Preferably Splunk and SPL experience.
Experience with document management and sustaining Security Operations Center (SOC) policies and run book procedures for incident response.
Experience with documenting root cause analysis and lessons learned.
Experience consuming and generating cybersecurity threat intelligence.
Experience across the technology stack. Familiarity with all OSI layers and expertise in some.
Experiencing using the following types of security tools:
- SIEM
- Firewalls
- Web Proxy
- Anti-Virus (AV)
- Next Gen Anti-Virus (NGAV)
- Endpoint Detection and Response (EDR)
- Sandboxing
- Virtual Machines
- Netflow analysis
- Malware Repositories
- Threat Intelligence
- Deception Stack
- Intrusion Detection/Prevention System (IDS/IPS)
- Security Orchestration Automation Response (SOAR)
- Phishing Triage
- User Behavior Analytics (UBA)
- Email Hygiene and Filtering
Experience interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Legal, Risk/Governance, etc.)
Experience working in a high-tempo, dynamic environment with a high performance team.
Experience with work ticketing systems (e.g. – ServiceNow, JIRA)
Experience with Threat Modeling and Kill Chain analysis

Relevant Work Experience:

1+ years

Education:

Bachelor's Degree Preferred

Special Qualifications:

The successful candidate will possess the following aptitudes and skillsets:
Able to maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and vendor offerings via self-directed learning and formal training.
Excellent critical thinking skills to understand available data and use it to support or refute potential hypothesis that explain the data. Use available data to develop and communicate conclusions and recommendations.
An ability to work and thrive in stressful situations. A demeanor that conveys calm professionalism in stressful situations.
An ability to maintain confidentiality of sensitive data and to follow proper ethical practices for using tools and accessing data.
A strong desire to determine root cause of events. A willingness to fully investigate all alternatives exhaustively until a conclusion can be supported.
Ability to self-prioritize tasks based on criticality and threat level.
Advanced written and oral communication skills.
The following certifications and courses are helpful, but, not required:
- Certified Ethical Hacker (CEH)
- GIAC: GSEC, GCIH, GCIA, GCED, GMON, GCDA, GDAT, GCFE or comparable
- CompTIA Security+

HCA Healthcare Information Technology Group (ITG) delivers healthcare IT products and services to HCA Healthcare's portfolio of business and partners, including Parallon, HealthTrust and Sarah Cannon.

For decades, ITG has been a pioneer in the industry, leading the transformation of healthcare into a new era of quality and connectivity. ITG relies on the breadth of the organization and depth of technical expertise to advance and enhance today’s healthcare and to enable our physicians and clinicians to provide world-class, innovative care for patients.

ITG employees rally around the noble cause of transforming healthcare through technology and find inspiration in the meaningful work they do—creating a culture that is "Healthcare Inspired."

If you want a career in technology and have a heart for healthcare, apply your expertise to a mission that matters.

ITG is always looking for sharp, skilled, committed team members to join its Healthcare Inspired mission and culture. With job opportunities spread throughout the company and all across the country, ranging from strategy to development, from project management to product support, you can use your unique and valued expertise in many ways for the noble cause of healthcare

Be a part of an organization that invests in you. We are actively reviewing applications. Highly qualified candidates will be promptly contacted by our hiring managers for interviews. Submit your application and help us raise the bar in patient care!

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Notice

Our Company’s recruiters are here to help unlock the next possibility within your career and we take your candidate experience very seriously. During the recruitment process, no recruiter or employee will request financial or personal information (Social Security Number, credit card or bank information, etc.) from you via email. The recruiters will not email you from a public webmail client like Gmail or Yahoo Mail. If you feel suspicious of a job posting or job-related email, let us know by clicking here.

For questions about your job application or this site please contact HCAhrAnswers at 1-844-422-5627 option 1.

Security Threat Engineer I - Military Veterans

Nashville, TN

Nashville, TN