Do you want to join an organization that invests in you as a(an) Security Threat Engineer II? At HCA Healthcare, you come first. HCA Healthcare has committed up to $300 million in programs to support our incredible team members over the course of three years.
Job Summary and Qualifications
JOB SUMMARY
The Threat Response Engineer II – serves as the last line of defense between HCA and the threat actors that wish to bring harm to HCA and the patients we serve – is a critical member of the 24/7 CDC team. They use state of the art technologies to detect threats on our network and eradicate them as a member of our Cyber Defense Center (CDC).
As a member of the CDC, they operate along with a small team of like-minded individuals with a passion for cyber security.
This role provides Tier 2+ analysis and response to cyber security threats. Threat Response Engineer IIs are expected to React to escalated incidents from junior analysts to provide specific expertise on specifically difficult incidents requiring elevated knowledge in Cyber Defense. Successful analysts must be naturally curious and self motivated to investigate and discover root causes of events while working in a fast-paced and sometimes stressful environment. Good teamwork, communication and leadership skills are vital.
GENERAL RESPONSIBILITIES
Major Responsibilities:
- Triage security alerts which have been detected by security tools, with a focus on high/critical severity alerts. Determine scope, root cause, and work with field resources to remediate.
- React to escalated incidents from junior analysts to provide specific expertise on specifically difficult incidents. Provide guidance to junior analysts on how to investigate these incidents, demonstrating tool usage, logs analyzed, alert disposition, etc.
- Provide Tier 2+ Incident Response to cyber events, and self-driven investigative efforts against incidents.
- Provide guidance to field resources on how to properly remediate a threat.
- Provide training to other team members to improve investigative techniques procedures for CDC operation and document teachings for the broader team to learn from.
- Continuously improve documentation of work products and processes.
- Engage with other teams as needed to investigate reported issues, outages, or downtime, and determine if there is a cyber-related cause.
- Execute HCA’s Incident Response plan as part of an incident response team. Serve as Incident Commander, Task Lead, or Scribe during incidents.
- Routinely collaborate with other teams in Cyber to provide feedback in areas such as detection tuning,
- SOAR automation, or threat intelligence dissemination.
Desired Experience:
- Experience as a member of a Cyber Incident Response Team (CIRT), SOC, or comparable team.
- Experience executing an Incident Response plan, preferably based on recognized industry standards (e.g. –
- NIST, SANS, etc.).
- Experience in Windows Artifact Analysis and Initial Forensic Analysis (e.g. – Program Execution,
- File/Folder opening, Account Usage, pulling memory, following proper evidence handling procedures, etc.) using industry standard tools and available logs (e.g. – Endpoint Detection and Response (EDR) tools).
- Experience in network traffic analysis to determine validity of detected events using available network logs collected via SIEM.
- Working knowledge of at least one major cloud platform (GCP, Azure, AWS)
- Experience investigating cloud-based threats, including identity compromise, suspicious API activity, data exfiltration, etc.
- Working knowledge of CI/CD pipelines, and experience triaging alerts regarding abuse of such platforms (leaked secrets, unauthorized access, data exfiltration, etc.).
- Working knowledge of using AI/LLM tools to support security workflows (log analysis, alert summarization, query generation) with an understanding of their limitations.
- Experience with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH).
- Advanced SIEM querying to correlate security events and identify malicious behavior.
- Experience with document management and sustaining Security Operations Center (SOC) policies and runbook procedures for alert investigation and incident response.
- Experience with documenting root cause analysis and lessons learned for security investigations.
- Experience consuming threat intelligence and using it to inform threat investigations.
- Experience interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Network Engineering, etc.).
- Experience working in a high-tempo, dynamic environment with a high-performance team.
- Eperience utilizing MITRE ATT&CK to identify adversary TTP’s to improve investigative processes.
- Experience analyzing malicious scripts, command line entries, and malware behavior.
- Experience across the technology stack. Familiarity with all the below tools with expertise in some:
- SIEM
- Endpoint Detection and Response (EDR/XDR)
- Security Orchestration Automation Response (SOAR)
- Case Ticketing Systems (e.g. – ServiceNow, JIRA).
- Firewalls
- Intrusion Detection/Prevention System (IDS/IPS)
- Web Proxy and Secure Web Gateway
- Anti-Virus (AV)
- Virtual Private Networks (VPN)
- Identity Providers and Directory Services
- Cloud Threat Monitoring Platforms
- CI/CD Platforms
- Virtual Machines
- Netflow Logging
- Malware Repositories
- Threat Intelligence Platforms
- Email Analysis and Sandbox Tools
RELEVANT WORK EXPERIENCE
EDUCATION
- Bachelor’s Degree Required
OTHER/SPECIAL QUALIFICATIONS
The successful candidate will possess the following aptitudes and skillsets:
- Experience as CDC lead/senior analyst role for 1+ years.
- Able to maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and industry trends via self-directed learning and formal training.
- Excellent critical thinking skills to understand available data and use it to support or refute potential hypothesis that explain the data. Use available data to develop and communicate conclusions and recommendations.
- An ability to work and thrive in stressful situations. A demeanor that conveys calm professionalism in stressful situations.
- An ability to maintain confidentiality of sensitive data and to follow proper ethical practices for using tools and accessing data.
- A strong desire to determine root cause of events. A willingness to fully investigate all alternatives exhaustively until a conclusion can be supported.
- Ability to self-prioritize tasks based on criticality and threat level.
- Advanced written and oral communication skills.
The following certifications and courses are helpful, but, not required:
- GIAC: GSEC, GSOC, GCIH, GCIA, GCED, GMON, GCDA, GDAT, GCFE or comparable
- CompTIA: Security+, CySa+
- Other: CEH, Google Professional Cloud Security Engineer
PHYSICAL DEMANDS/WORKING CONDITIONS
- Extensive periods of sitting or standing at workstation to include use of mouse, keyboard, and monitor(s).
Benefits
HCA Healthcare, offers a total rewards package that supports the health, life, career and retirement of our colleagues. The available plans and programs include:
- Comprehensive benefits for medical, prescription drug, dental, vision, behavioral health and telemedicine services
- Wellbeing support, including free counseling and referral services
- Time away from work programs for paid time off, paid family leave, long- and short-term disability coverage and leaves of absence
- Savings and retirement resources, including a 401(k) Plan with a 100% match on 3% to 9% of pay (based on years of service), Employee Stock Purchase Plan, flexible spending accounts, preferred banking partnerships, retirement readiness tools, rollover support and financial wellbeing counseling
- Education support through tuition assistance, student loan assistance, certification support, dependent scholarships and a partnership with Galen College of Nursing
- Additional benefits for fertility and family building, adoption assistance, life insurance, supplemental health protection plans, auto and home insurance, legal counseling, identity theft protection and consumer discounts
Learn more about Employee Benefits
Note: Eligibility for benefits may vary by location.
HCA Healthcare has been recognized as one of the World's Most Ethical Companies® by the Ethisphere Institute more than ten times. In recent years, HCA Healthcare spent an estimated $3.7 billion in cost for the delivery of charitable care, uninsured discounts, and other uncompensated expenses.
"Good people beget good people."- Dr. Thomas Frist, Sr.
HCA Healthcare Co-Founder
We are a family 270,000 dedicated professionals! Our Talent Acquisition team is reviewing applications for our Security Threat Engineer II opening. Qualified candidates will be contacted for interviews. Submit your resume today to join our community of caring!
We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.
