Lead Cybersecurity Incident Response Analyst

Penn Medicine - Philadelphia, PA

Full-time - Mid Level

Remote - Philadelphia, PA

Ambulatory Health Care Services

About the position

Penn Medicine is dedicated to our tripartite mission of providing the highest level of care to patients, conducting innovative research, and educating future leaders in the field of medicine. Working for this leading academic medical center means collaboration with top clinical, technical, and business professionals across all disciplines. The Lead Cybersecurity Incident Response Analyst plays a crucial role in ensuring that key cybersecurity operations response activities are completed effectively. This position involves providing technical direction and mentoring to junior and senior analysts, coordinating multiple 24x7 cybersecurity incident follow-up activities, and conducting technical research and analysis of threats and vulnerabilities affecting information systems. The role also includes participation in various cybersecurity program activities such as risk assessment, risk management, and risk remediation. The Lead Analyst will liaise with other members of the Information Services team, coordinate responses to cybersecurity incidents, and maintain necessary documentation. The position requires on-site presence for the first six months, with the possibility of remote work after the introductory period is complete.

Responsibilities

• Provide technical leadership and coaching to multiple junior and senior SOC analysts, ensuring the highest quality in the delivery of response services
• Assist management in process, service and SLA development, metrics creation and management and maturity enhancements
• Receive escalations from the SOC team and conduct investigations as requested
• Conduct interviews as needed
• Investigate suspicious network and endpoint activity
• Provide feedback on IR playbooks, runbooks, and plans as needed
• Partner with information security engineers to implement and maintain security technologies
• Collaborate with information assurance advisors to address network and endpoint security risks
• Participate in vulnerability management, including scanning and remediation
• Manage the forensic chain of evidence as needed
• Maintain written documentation on investigations
• Perform duties in accordance with Penn Medicine and entity values, policies, and procedures
• Other duties as assigned to support the unit, department, entity, and health system organization

Requirements

• Bachelor's degree (Required)
• 7+ years of experience in information technologies, especially information security, such as security operations and incident response, regulatory compliance or audit, vulnerability management, security engineering or similar experience (Required)
• 3+ years of experience with incident response technology, process, and programs (Required)
• 0-1 years of familiarity with security standards and frameworks such as: HIPAA, PCI DSS, HITRUST, NIST, ISO, etc. (Required)
• 0-1 years of experience with Incident Response lifecycle and supporting technologies, including hands-on experience with modern SIEM/SOAR platforms, EDR tools, NDR and/or NBAD tools, or the like (Required)
• Information security certifications, such as Security+, Network+, CCNA Security, GSEC, GCIA, GCFA, GPEN, CEH (Preferred)

Benefits

• Comprehensive compensation and benefits program
• Prepaid tuition assistance program
• Health and wellness programs