Security Threat Engineer II

Do you want to join an organization that invests in you as a(an) Security Threat Engineer II? At HCA Healthcare, you come first. HCA Healthcare has committed up to 300 million in programs to support our incredible team members over the course of three years.

JOB SUMMARY

The Threat Response Engineer II – serves as the last line of defense between HCA and the threat actors that wish tobring harm to HCA and the patients we serve – is a critical member of the 24/7 CDC team. They use state of the art technologies to detect threats on our network and eradicate them as a member of our Cyber Defense Center (CDC).As

a member of the CDC, they operate along with a small team of like-minded individuals with a passion for cybersecurity.

This role provides Tier 2+ analysis and response to cyber security threats. Threat Response Engineer IIs are expected to React to escalated incidents from junior analysts to provide specific expertise on specifically difficult incidents requiring elevated knowledge in Cyber Defense. Successful analysts must be naturally curious and self-motivated to investigate and discover root causes of events while working in a fast-paced and sometimes stressful environment.

Good teamwork, communication and leadership skills are vital.

GENERAL RESPONSIBILITIES

Major Responsibilities:

• React to escalated incidents from junior analysts to provide specific expertise on specifically difficult incidents. Investigate and triage these escalated events based on criticality.
• Provide recommendations on how to mitigate the threats. Use analytic techniques and critical thinking to solve complex and new cyber incidents.
• Provide Tier 2+ Incident Response to cyber events, and self-driven investigative efforts against incidents.
• Provide guidance to field resources on how to properly remediate a threat.
• Provide training to other CDC team members to improve tools, techniques, and procedures for CDC operation.
• Continuously improve documentation of work products and processes.
• Participate in red/blue team exercises.
• Execute HCA’s Incident Response plan as part of an incident response team. Serve as Incident

Commander, Task Lead, or Scribe during incidents.

• Routinely collaborate with individuals and teams from across the enterprise.

Desired

Experience:

• Experience as a member of a Cyber Incident Response Team (CIRT) or comparable team.
• Experience executing an Incident Response plan, preferably based on recognized industry standards (e.g. – NIST, SANS, etc).
• Experience in Windows Artifact Analysis and Initial Forensic Analysis (e.g. – Program Execution, File/Folder opening, Account Usage, pulling memory, following proper evidence handling procedures, etc) using industry standard tools and available logs (e.g. – Endpoint Detection and Response (EDR) tools).
• Experience in Memory Analysis using tools such as Volatility
• Experience in network forensic analysis to determine validity of detected events using available network logs collected via SEIM.
• Experience in DFIR (Digital Forensics Incident Response).
• Experience with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH).
• Experience in performing security analysis or reporting utilizing Security Incident and Event Management (SIEM) Technologies. Preferably Splunk and SPL experience.
• Experience with document management and sustaining Security Operations Center (SOC) policies and run book procedures for incident response.
• Experience with documenting root cause analysis and lessons learned.
• Experience consuming and generating cybersecurity threat intelligence.
• Experience across the technology stack. Familiarity with all OSI layers and expertise in some.

Experience using the following types of security tools:

• SIEM
• Firewalls
• Web…