Information Security Analyst-2

About Us:

Our purpose is to help clients exceed their financial health goals. Across the reimbursement cycle, our scalable solutions and clinical expertise help solve programmatic needs. Enabling our teams with leading technology allows analytics to guide our solutions and keeps us accountable achieving goals. 

We build long-term careers by investing in YOU. We seek to create an environment that cultivates your professional development and personal growth, as we believe your success is our success.  

ESSENTIAL DUTIES AND RESPONSIBILITIES: 
Note: The essential duties and responsibilities below are intended to describe the general duties and responsibilities of this position and are not intended to be an exhaustive statement of duties. This position may perform all or most of the primary duties listed below. Specific tasks, responsibilities or competencies may be documented in the Team Member’s performance objectives as outlined by the Team Member’s immediate Leadership Team Member.

Senior SOC Analyst :

Job Summary

We are seeking an experienced Senior SOC Analyst to strengthen our Cyber Security Operations Center (SOC). The ideal candidate will have strong hands-on experience with CrowdStrike Falcon EDR, CrowdStrike Next-Gen SIEM, Microsoft Defender security solutions, Email Security platforms, and advanced threat hunting capabilities. The role requires expertise in security monitoring, incident investigation, detection engineering, and SIEM query development using CrowdStrike Query Language (CQL) and/or Kusto Query Language (KQL).

The candidate will proactively identify, investigate, and respond to cybersecurity threats while continuously improving detection and response capabilities across the enterprise.

Key Responsibilities

Security Monitoring & Incident Response

• Monitor security alerts from CrowdStrike Falcon, NG-SIEM, Microsoft Defender, email security platforms, and other security controls.
• Perform triage, analysis, containment, eradication, and recovery activities for security incidents.
• Lead investigations involving malware, phishing, ransomware, insider threats, and suspicious user activities.
• Conduct root cause analysis and document incident findings and recommendations.
• Coordinate with IT, Infrastructure, Cloud, Network, and Business teams during incident response activities.

CrowdStrike EDR & NG-SIEM Administration

• Manage and optimize CrowdStrike Falcon EDR policies and detection configurations.
• Develop and fine-tune custom detection rules and alerting logic.
• Configure and manage CrowdStrike NG-SIEM data ingestion, use cases, dashboards, and reporting.
• Perform endpoint threat analysis and remediation using Falcon Real-Time Response.
• Support deployment and maintenance of Falcon Data Protection, Identity Protection, and Endpoint Security modules.

Threat Hunting & Detection Engineering

• Conduct proactive threat hunting activities using CrowdStrike Falcon, NG-SIEM, and Defender telemetry.
• Identify indicators of compromise (IOCs), indicators of attack (IOAs), and anomalous behaviors.
• Develop detection content using CQL and KQL queries.
• Build and maintain threat hunting playbooks and investigation workflows.
• Research emerging threats, attacker techniques, and industry threat intelligence.

Microsoft Defender Security Operations

• Investigate alerts generated by Microsoft Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender XDR.
• Perform advanced hunting using KQL.
• Optimize Defender detection rules and reduce false positives.
• Correlate Defender telemetry with CrowdStrike and SIEM events.

Email Security Operations

• Manage and investigate alerts from Mimecast, Microsoft Defender for Office 365, Proofpoint, or similar email security platforms.
• Analyze phishing, spoofing, malicious attachments, and business email compromise (BEC) incidents.
• Develop email security monitoring and response procedures.
• Coordinate end-user awareness and phishing response activities.

Reporting & Governance

• Develop SOC operational dashboards and security metrics.
• Create executive and management reports on threats, incidents, and trends.
• Support audit, compliance, and cyber risk assessment activities.
• Mentor junior SOC analysts and support skill development across the SOC team.

Required Qualifications

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
• 5-8+ years of experience in Security Operations Center (SOC) or Cyber Defense environments.
• Minimum 2+ years of hands-on experience with CrowdStrike Falcon EDR.
• Experience working with CrowdStrike NG-SIEM.
• Experience with Microsoft Defender XDR ecosystem.
• Strong understanding of cybersecurity frameworks, attack techniques, and threat intelligence.
• Experience in incident response and forensic investigations.

Technical Skills

Mandatory Skills

• CrowdStrike Falcon EDR
• CrowdStrike NG-SIEM
• CrowdStrike Query Language (CQL)
• Microsoft Defender XDR
• Kusto Query Language (KQL)
• Threat Hunting
• Incident Response
• Endpoint Security
• IOC/IOA Analysis
• Email Security (Mimecast)
• SIEM Operations
• Log Analysis
• Malware Analysis
• Security Investigations

Preferred Skills

• Azure Security Controls
• Network Security Monitoring
• MITRE ATT&CK Framework
• PowerShell scripting
• Python scripting
• SOAR platforms

Certifications (Preferred)

• CrowdStrike Falcon Administrator
• CrowdStrike Falcon Analyst
• Microsoft SC-200 Security Operations Analyst
• Microsoft SC-100 Cybersecurity Architect
• GCIH (GIAC Certified Incident Handler)
• GCFA (GIAC Certified Forensic Analyst)
• CompTIA CySA+
• CISSP

Key Competencies

• Advanced Threat Hunting
• Detection Engineering
• Security Analytics
• Incident Management
• Problem Solving
• Analytical Thinking
• Communication & Reporting
• Stakeholder Management
• Team Mentoring
• Continuous Improvement Mindset

Seeking a Senior SOC Analyst with strong hands-on experience in CrowdStrike Falcon EDR, CrowdStrike Next-Gen SIEM, Microsoft Defender XDR, Email Security platforms (Mimecast/Defender O365), advanced threat hunting, incident response, and detection engineering using CQL and KQL. Experience building use cases, threat detection content, and leading cyber incident investigations is highly desirable.

PHYSICAL DEMANDS:
Note: Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions as described. Regular eye-hand coordination and manual dexterity is required to operate office equipment. The ability to perform work at a computer terminal for 6-8 hours a day and function in an environment with constant interruptions is required. At times, Team Members are subject to sitting for prolonged periods. Infrequently, Team Member must be able to lift and move material weighing up to 20 lbs. Team Member may experience elevated levels of stress during periods of increased activity and with work entailing multiple deadlines.
A job description is only intended as a guideline and is only part of the Team Member’s function. The company has reviewed this job description to ensure that the essential functions and basic duties have been included. It is not intended to be construed as an exhaustive list of all functions, responsibilities, skills and abilities. Additional functions and requirements may be assigned by supervisors as deemed appropriate.