A minimum of eight years of information technology experience, including at least five years in a cybersecurity role focused on protecting, detecting, and responding.
Knowledge of MITRE ATT&CK and Cyber Kill Chain frameworks.
Experience establishing or participating in Blue Team exercises.
Experience with Windows, macOS, and Linux operating systems.
Knowledge of the system development lifecycle.
Experience deploying, managing, and using security operations tools such as SIEM, endpoint protection and management, data loss prevention, vulnerability management, firewalls, web application firewalls, antivirus solutions, email protection solutions, incident response, and threat hunting and management tools.
Scripting experience with PowerShell, JavaScript, or Python.
Experience working with identity and access control management tools.
An Associate’s degree with a major in a computer-related field or similar technical field from an accredited institution, or two additional years of cybersecurity work experience in lieu of the degree.
Comprehensive knowledge of SIEM and SOAR.
Comprehensive knowledge of MITRE ATT&CK and Cyber Kill Chain frameworks.
Comprehensive knowledge of Blue Teaming and endpoint protection technologies.
Comprehensive knowledge of cloud technologies.
Comprehensive knowledge of OSI model layers, IP routing, and TCP/IP operation.
Comprehensive knowledge of computer forensics.
Comprehensive knowledge of HIPAA, NIST 800-53, NIST CSF, Zero Trust Architecture, and other security standards.
Comprehensive knowledge of vulnerability scanning technologies, security monitoring, incident response, risk analysis, risk mitigation strategies, networking technologies and protocols with an emphasis on TCP/IP, Defense in Depth strategies, advanced persistent threats and associated tactics, indicators of compromise and attack, vulnerability management, cloud security, and Windows, macOS, and Linux.
Strong planning, organization, critical thinking, decision-making, and verbal and written communication skills.
Ability to work as a member of a team, adapt to change, contribute to team planning and improvement activities, learn and apply new concepts, share advanced skills, foster team excellence, and stay current with industry trends and standards.
Ability to lift server appliance weights up to 50 pounds, with a back brace required when lifting 50 pounds or heavier.
Responsibilities
Monitor firewalls, network and host intrusion prevention and detection systems, virtual private networks, threat intelligence platforms, endpoint protection, security training platforms, email security, forensic tools, public, private, and hybrid cloud infrastructure, identity and access management systems, and physical security systems.
Monitor security operations center tools and dashboards.
Perform threat hunting across the environment using security operations center tools and internal or external threat intelligence sources.
Architect cybersecurity solutions for on-premises and cloud computing environments.
Participate in and lead cybersecurity engineering projects.
Assist with risk analysis activities.
Assist with designing and implementing controls to mitigate risk.
Identify attack surface reduction opportunities through vulnerability data analysis and identify opportunities for process improvement and automation.
Monitor security systems and provide early response to potential threats.
Manage security incident response and serve as an escalation point for investigations involving advanced and sophisticated threat actors and tactics, techniques, and procedures.
Design, test, and implement response playbooks, orchestration workflows, and automations.
Research, recommend, and test new security technologies and platforms.
Analyze technologies and establish processes and protocols to prevent unauthorized entry into company networks and systems.
Support automation and orchestration to maximize team capacity and reduce routine tasks.
Create countermeasures to protect company personnel and information assets.
Document, prioritize, and formally report incidents, root-cause analyses, and after-action reviews.
Coordinate internal and external resources protecting enterprise systems.
Attend and participate in change-management policy discussions and meetings.
Validate and improve preventive controls and incident response using breach and attack simulation solutions.
Work analytically on tactical and strategic problems within the vulnerability management program.
Plan, develop, configure, and execute vulnerability scans across corporate and business information systems on premises and in the cloud.
Mature the vulnerability management program in collaboration with other Information Security teams.
Respond proactively to tickets and incidents.
Collect and aggregate information from varied sources and formats, monitor vulnerability threat levels, and provide metrics.
Collaborate with Compliance, Internal Audit, business teams, and others to identify, analyze, and communicate risk and support vulnerability management requirements.
Identify, develop, and implement mechanisms to detect vulnerabilities and how they may lead to corporate incidents.
Coordinate with the Incident Response team to remediate security incidents as needed.
Collaborate with business areas and project teams to develop security solutions addressing compliance requirements.
Work with information systems owners and administrators to understand security needs and implement practices consistent with security policies.
Build and maintain supplier partnerships.
Create and maintain environmental documentation, tasks, and change records.
Advocate internally and externally for compliance with security measures protecting corporate applications and environments.
Perform Static Application Security Testing and Dynamic Application Security Testing.
Perform application security testing for web, application programming interface, thick-client, and mobile applications and their supporting infrastructure.
Use business requirements, user stories, design documents, and architecture documents to determine testing scope and create targeted security user stories or misuse cases.
Manage and execute security assessments for multiple projects while meeting project timelines.
Analyze source code to mitigate identified weaknesses and vulnerabilities.
Ensure containerization security best practices are maintained and vulnerabilities are addressed.
Desired Qualifications
Relevant security certifications.
Overview
What you can expect!
Find joy in serving others with IEHP! We welcome you to join us in “healing and inspiring the human spirit” and to pivot from a “job” opportunity to an authentic experience!
Reporting to the Manager, Information Security Operations, the Engineer III – Security Analyst services as a senior cybersecurity practitioner and consultant, advancing the organization’s defensive posture across on-premises and cloud environments. This position maintains and improves security policies, standards, procedures, and response playbooks; produces clear incident documentation, root-cause analyses, and after-action review; and collaborates with business stakeholders to align security controls with organizational requirements. The Engineer III - Security Analyst mentors team members, evaluates emerging technologies, and champions continues improvement to mature security operations and ensure best practices. This position provides guidance to business units and technology stakeholders during the deployment of critical business and technology initiatives utilizing deep understanding of global threat actors and their tactics, techniques, and procedures employed during cyberattacks. This position supports various Information Technology Security functional areas related to one or more of the following: Application Security, Security Operations and Vulnerability.
Commitment to Quality: The IEHP Team is committed to incorporate IEHP’s Quality Program goals including, but not limited to, HEDIS, CAHPS, and NCQA Accreditation.
Additional Benefits
Perks
IEHP is not only committed to healing and inspiring the human spirit of our Members, but we also aim to match our team members with the same energy by providing prime benefits and more.
Competitive salary
State of the art fitness center on-site
Medical Insurance with Dental and Vision
Life, short-term, and long-term disability options
Career advancement opportunities and professional development
Wellness programs that promote a healthy work-life balance
Flexible Spending Account – Health Care/Childcare
CalPERS retirement
457(b) option with a contribution match
Paid life insurance for employees
Pet care insurance
Key Responsibilities
Monitor firewalls, network and host intrusion prevention/detection systems, virtual private networks, threat intelligence platforms, endpoint protection, security training platforms, email security, forensic tools, public/private/hybrid cloud infrastructure, identity and access management systems, and physical security systems.
Monitor security operations center tools and dashboards.
Perform threat hunting activities using security operations center tools across the environment using internal or external threat intelligence sources.
Architect cybersecurity solutions for on-premises and cloud computing environments.
Participate in and/or leads cybersecurity engineering projects.
Assist with risk analysis activities.
Assist with designing and implementing controls to mitigate risk.
Identify attack surface reduction opportunities through vulnerability data analysis and/or identify opportunities for process improvements and automation.
Perform any other duties as required to ensure Health Plan operations and department business needs are successful.
Security Operations:
Monitor security systems and provide early response to potential threats.
Manage security incident response; serve as escalation point for conducting investigations into security incidents involving advanced and sophisticated threat actors and TTPs.
Design, test, and implement response playbooks, orchestration workflows and automations.
Research, recommend and test new security technologies and platforms
Analyze technologies and establish highly effective processes and protocols to ensure comprehensive protection exists to prevent unauthorized entry into company networks and systems.
Support automation and orchestration to maximize team talent and reduce routine tasks.
Drive creation of countermeasures to protect company personnel and information assets.
Document, prioritize, and formally report incidents, root cause analyses, and after-action reviews.
Coordinate between internal and external resources protecting enterprise systems.
Periodically attend and participate in change management policy discussions and meetings.
Validate and improve the effectiveness of preventative controls and incident response utilizing the understanding of breach and attack simulation solutions.
Motivate employees to maximize rigorous system security controls, focusing on reducing complexity and maturing security practices.
Vulnerability:
Work analytically to solve both tactical and strategic problems within the vulnerability management program.
Plan, develop, configure, and execute vulnerability scans on a wide variety of corporate and business information systems both on prem and cloud based.
Mature the vulnerability management program in collaboration with other Information Security teams.
Respond to tickets and incidents in a proactive manner.
Collect and aggregate information from a wide variety of sources and formats for relevance to our environment; monitors and provides metrics on threat level of vulnerabilities.
Collaborate and communicate with Compliance, Internal Audit, the Business teams, and others to identify, analyze, and communicate risk; and provide support around vulnerability management within their business requirements.
Identify, develop, and implement mechanisms to detect vulnerabilities and how they may lead to corporate incidents to enhance compliance with and support of security standards and procedures.
Coordinate with the Incident Response team to remediate security incidents as needed.
Collaborate with business areas and project teams to develop security solutions that address compliance requirements that may impact security.
Work with information systems owners and administrators to understand their security needs and assist with implementing practices and procedures consistent with security policies.
Build and maintain supplier partnerships to further the company mission and goals.
Create and maintain environmental documentation, tasks, change records, etc.
Act as the lead advocate internally and externally for compliance on security measures to protect corporate applications and environments.
Perform application security testing on various types of applications such as Web, API's, Thick Client's, Mobile, etc., inclusive of the supporting infrastructure components.
Leverage application artifacts such as business requirements, user stories, design documents, architecture documents to understand the testing scope and create targeted security user stories or misuse cases.
Manage and execute security assessments for multiple projects simultaneously and ensure project timelines are met.
Analyze source code to mitigate identified weaknesses and vulnerabilities within the system.
Ensure containerization security best practices are maintained and vulnerabilities are addressed.
Qualifications
Education & Requirements
A minimum of eight (8) years of IT experience required with at least five (5) years in a cybersecurity role with a focus on protect, detect, and respond in addition to the following:
Mitre ATT&CK and Cyber Kill Chain frameworks
Establishing or participating in Blue Team exercises
Computer operating systems such as Windows, MacOS and Linux
System development lifecycle
Deploying, managing, and using Security Operations tools such as SIEM, EPM, DLP, Vulnerability Management, Firewalls, WAFs, Antivirus Solutions, Email Protection Solutions, Incident Response and Threat hunting and management
Scripting experience such as PowerShell, JavaScript, or Python
Experience working with Identity and Access Control Management Tools
Associate’s degree with a major in computer-related field or similar technical field from an accredited institution required
In lieu of the required degree, a minimum of two (2) years of cybersecurity work experience is required
This experience is in addition to the minimum years listed in the Experience Requirements above
Relevant security certifications preferred
Key Qualifications
Comprehensive knowledge and deep understanding of the following:
SIEM and SOAR
ATT&ACK and Cyber Kill Chain frameworks
Blue Teaming
Endpoint protection technologies
Cloud technologies
OSI Model layers, IP Routing, TCP/IP Operation
Scripting experience such as PowerShell, JavaScript, or Python
Computer forensics knowledge and experience
Security standards such as HIPAA, NIST 800-53, NIST CSF, Zero Trust Architecture, and others
Vulnerability scanning technologies
Security monitoring and incident response
Risk analysis and risk mitigation strategies
Networking technologies and networking protocols with an emphasis on TCP/IP
Defense in Depth strategies
Security Operations Tools such as SIEM, EPM, DLP, Vulnerability scanners, Firewalls, WAFs, Antivirus Solutions, Email Protection Solutions, Incident Response and Threat Management
Advanced Persistent Threats (APT) and associated tactics
Identifying indicators of compromise and indicators of attack
Vulnerability management
Cloud security and/or technologies
Computer operating systems such as Windows, MacOS and Linux
Strong planning, organization, critical thinking, decision-making and communication (verbal and written) skills
Proven ability to:
Work as a member of a team
Show willingness to be flexible and adaptable to change in a dynamic work environment
Contribute and participate in team activities and planning regarding improving team skills, awareness, communication, reputation, and quality of work
Learn and apply new concepts
Work within a team to consistently learn and share advanced skills and foster team excellence
Stay up to date with current knowledge of industry trends and standards.
Projects involving lift server appliance weights up to 50 lbs.; back brace must be worn with lifting 50 pounds or heavier
Start your journey towards a thriving future with IEHP and apply TODAY!
Work Model Location
This position is on a hybrid work schedule. (Mon & Fri - remote, Tues - Thurs onsite in Rancho Cucamonga, CA.)