Cyber Security Analyst III

SUMMARY Senior Level. Employees in this third (3rd) level require greater knowledge, training, and/or experience than level 2. The amount of work review, checks, and supervision is less for an employee at level 3 than at level 2. Complexity or variety of work is higher than level 2 and may involve greater technical, mathematical, or scientific skills than level 2. The scope of assignments may vary when compared to level 2. Some organizations refer to level 3 as the senior level. Typically requires experience and advanced specialized training; works on own initiative and requires little supervision. Provide all the duties of the Cybersecurity Analyst 2. At Level 3, employees are expected to learn many systems and serve as a primary for multiple systems and a backup for other systems. The Cybersecurity Analyst 3 position include assignments of special nature to include but not limited to, phishing, physical access, camera systems, user activity monitoring, forensic investigations endpoint protection maintenance and monitoring, insider threat monitoring, Security Operations Center (SOC) analyst duties, audits, vulnerability management, and monitoring of authorized access. Provides guidance to lower-level Cybersecurity Analysts at Level 1 or 2. Assist in the development and dissemination of security policies and procedures, and coordination of security issues with the Information Services Security team, the Chief Information Security Officer (CISO), and the Corporate Compliance Officer. Works with enterprise systems, software, and tools to ensure that confidentiality, integrity, and availability of the business and electronic health record data is always maintained. Provide periodic full system audits of user access within our business and clinical application systems. Provides security analyst functions through security software and tools. RESPONSIBILITIES  Monitors access to systems, departments and users, as well as outside entities that have submitted the correct paperwork.  Ensure adequate security is provided to users of our business and clinical applications.  Maintain, update, and create security documentation and forms for management in the requisition of user security access.  Maintains and monitors endpoint protection systems and other systems to discover anomalies.  Maintain, update, and create email phishing campaigns and follow up to replies, requests and failures to ensure remediation training is completed.  Maintain and monitor email security systems.  Work with the security stack of tools to ensure security operations are being performed according to tasks.  Work with physical access employees to ensure backup of critical systems.  Work with departmental staff in assisting with reduction of vulnerabilities discovered by system tools.  Works with the Security Event and Incident Management (SIEM) analyst to monitor anomalies in the systems.  Responds to threat intelligence alerts and ensures that the appropriate teams are notified for remediation or action.  Performs the Investigations of suspected security violations. III. Specialized duties. Handles major incidents escalated to them by the incident responders. Performs or at least supervises vulnerability assessments and penetration tests to identify possible attack vectors. Proactively identifies possible threats, security gaps and vulnerabilities that might be unknown. Recommends ways to optimize the deployed security monitoring tools as they gain reasonable knowledge about a possible threat to the systems. Additionally, any critical security alerts, threat intelligence, and other security data provided by tier 1 and tier 2 analysts need to be reviewed at this tier. Leads complex investigations and incident responses, performs threat hunting and forensic analysis. QUALIFICATIONS Prefer 2 years of college, preferably a Computer Science, Cybersecurity, or Information Technology degree; significant experience may substitute for formal training. The candidate needs 4 or more years of related experience in information systems security or security analyst/auditor roles. Must obtain and maintain at least one cybersecurity certification, Security+, CISSP, etc. preferred