Position Summary:
Under minimal supervision, the Cyber Security Operations Analyst Sr. is responsible for all operational tasks related to cyber security monitoring and response, including the analysis, documentation, and escalation of cyber security incidents. This position involves playbook development, automation configuration, processing threat intelligence, threat hunting, addressing security incident tickets, tracking security incident data, and mentoring other members in Information Security Operations.
Responsibilities:
Essential Functions- Possess advanced level knowledge of Enterprise Log Management, SIEM and EDR solutions
- Creates detection rules in various security tools.
- Creates Work instructions, Playbooks and SOP’s
- Advanced level understanding of information technology methodologies in multiple disciplines
- Strong understanding of a variety of network protocols
- Strong knowledge of Windows and Linux operating systems, client and server
- Strong interpersonal skills with a positive and enthusiastic attitude
- Performs daily security systems alert monitoring
- Performs expert file level analysis of Microsoft and Linux operating systems
- Performs advanced level of Malware Analysis
- Performs basic Reverse Engineering of executable files.
- Reviews system and application logs for malicious activity
- Maintains a high level of technical expertise on selected security products
- Maintains knowledge of security laws, principles and practices.
- Remains current with emerging threats and trends.
- Leverages Threat Intelligence and be able to incorporate it into various Security tools
- Participates in a lead role in conducting forensic investigations for HR, Legal, and Incident Response.
- Creates Threat Advisories and Forensic Reports
- Advanced Knowledge of Threat intelligence and the ability to apply it in various systems
- Participates in Threat Hunting activities
- Develops and lead Purple Team exercises
- Develops and maintain automation and orchestration playbooks
- Participates in detection rule validation
- Understands penetration testing knowledge and be able to detect offensive techniques
- Creates advanced scripts in Bash, PowerShell, and/or Python to perform tasks and automations
- Ability to work individually and on team projects in an environment of teamwork and cooperation.
- Ability to take part in 24/7 on-call rotation.
- Performs other related duties as required.
- Maintains reasonably regular, punctual attendance consistent with Orlando Health policies, the ADA, FMLA and other federal, state and local standards.
- Maintains compliance with all Orlando Health policies and procedures.
Other Related Functions
Takes an active role in the development of the security operations program.
Qualifications:
Education/Training
Bachelor’s degree preferred. Associate’s Degree or equivalent and five (5) years of directly related work experience may substitute for the Bachelor’s degree (in addition to the requirements listed in the Experience section).
Licensure/Certification
Required: Two or more of the following Security or Network related certifications: (SC-100, AZ-500, MZ-500, CISM / CISSP / GIAC (500+ series) / SSCP / EnCE / OSCP / CyberOp Professional / or similar) *or ability to obtain within 180 days.
Experience
Five (5) years of Information Technology or related experience with three (3) years of Information Security experience.