Company Overview:

Cohere Health is a fast-growing clinical intelligence company that’s improving lives at scale by promoting the best patient-specific care options, using leading edge AI combined with deep clinical expertise. In only four years our solutions have been adopted by health insurance plans covering over 15 million people, while our revenues and company size have quadrupled. That growth combined with capital raises totaling $106M positions us extremely well for continued success. Our awards include: 2023 and 2024 BuiltIn Best Place to Work, Top 5 LinkedIn™ Startup, TripleTree iAward, multiple KLAS Research Points of Light, along with recognition on Fierce Healthcare's Fierce 15 and CB Insights' Digital Health 150 lists.

Opportunity Overview:

We are seeking a skilled and experienced Security Analyst to join our cybersecurity team. The successful candidate will play a pivotal role in safeguarding our organization's digital assets by actively participating in incident response, leveraging managed detection and response (MDR) tools, and enhancing log management practices. The Security Analyst will work closely with our Managed Security Service Provider (MSSP) and internal teams to ensure robust security monitoring, efficient incident escalation, and proactive threat hunting.

Last but not least: People who succeed here are empathetic teammates who are candid, kind, caring, and embody our core values and principles. We believe that diverse, inclusive teams make the most impactful work. Cohere is deeply invested in ensuring that we have a supportive, growth-oriented environment that works for everyone.

What you will do:

Cloud Security Expertise:

Demonstrate advanced proficiency in cloud security, particularly within AWS environments.
Stay abreast of the latest AWS security services, tools, and best practices.

Incident Response:

Lead and manage the incident response process, including detection, analysis, containment, eradication, and recovery of security incidents.
Develop and maintain incident response playbooks, ensuring timely and effective handling of security incidents.
Conduct post-incident analysis and create detailed incident reports with recommendations for improving security posture.

Managed Detection and Response (MDR):

Utilize MDR tools to monitor security alerts, identify potential threats, and coordinate response efforts.
Analyze alerts generated by MDR tools, determine their severity, and take appropriate actions to mitigate threats.
Collaborate with MDR service providers to ensure optimal configuration and performance of security monitoring systems.

Log Enhancement and Management:

Enhance log management practices, including log collection, normalization, and correlation.
Develop and implement log retention and rotation policies to comply with industry standards and regulations.
Analyze logs to identify suspicious activities, anomalies, and potential security breaches.

Incident Escalation:

Act as the primary point of contact for Level 2 incident escalation and triage.
Assess and prioritize security incidents based on their impact and severity.
Coordinate with relevant teams and stakeholders to escalate incidents to higher levels of response when necessary.

Level 2 Alert Triage:

Perform in-depth analysis of security alerts and incidents, determining false positives and true positives.
Investigate and respond to Level 2 alerts, ensuring timely resolution and documentation.
Develop and maintain detailed records of all triaged alerts and actions taken.

Collaboration with Managed Security Service Provider (MSSP):

Collaborate closely with the MSSP to ensure seamless communication and coordination during security incidents.
Review and validate the quality of services provided by the MSSP, including threat detection and response capabilities.
Participate in regular meetings with the MSSP to discuss security trends, incident reports, and service improvements.

Alert Tuning and Optimization:

Continuously tune and optimize security alerts to reduce false positives and enhance detection accuracy.
Work with the security operations team to refine alert thresholds and improve the overall effectiveness of security monitoring.

Threat Hunting Exercises:

Proactively hunt for threats and vulnerabilities within the organization's environment.
Conduct threat intelligence research and analysis to identify emerging threats and attack vectors.
Develop and execute threat hunting exercises to identify and mitigate potential security risks.

Your background & requirements:

Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent work experience.
3+ years of experience in a security analyst role, with a focus on incident response, log management, and threat detection.
Strong knowledge of MDR tools, SIEM platforms, and security monitoring technologies.
Experience with incident response frameworks and best practices (e.g., MITRE - ATT&CK, MITRE D3FEND, NIST CSF, SANS).
Proficiency in analyzing security logs, alerts, and incidents.
Excellent problem-solving and analytical skills, with the ability to work under pressure.
Strong communication and collaboration skills, with the ability to work effectively with cross-functional teams and external partners.
Relevant certifications such as Security +, CEH, GCIH, or similar are preferred.

We can’t wait to learn more about you and meet you at Cohere Health!

Equal Opportunity Statement:

Cohere Health is an Equal Opportunity Employer. We are committed to fostering an environment of mutual respect where equal employment opportunities are available to all. To us, it’s personal.

The salary range for this position is $80,000 to $105,000; as part of a total benefits package which includes health insurance, 401k and bonus. In accordance with state applicable laws, Cohere is required to provide a reasonable estimate of the compensation range for this role. Individual pay decisions are ultimately based on a number of factors, including but not limited to qualifications for the role, experience level, skillset, and internal alignment.

#LI-Remote

#BI-Remote

Apply for this Job

* Required

First Name *

Last Name *

Email *

Phone *

Resume/CV *

Dropbox Google Drive

(File types: pdf, doc, docx, txt, rtf)

Cover Letter

Dropbox Google Drive

(File types: pdf, doc, docx, txt, rtf)

LinkedIn Profile

Website

Have you performed threat hunting, red team, or blue team exercises? *

Are you experienced with Utilized Managed Detection and Response tools like (Expel, Red Canary, Artic Wolf)? *

Do you have an Offensive Security Certified Professional (OSCP) cert? *

Do you have a Certified Ethical hacker (CEH) cert? *

How did you hear about us? *

Do you now, or will you in the future require immigration sponsorship for work authorization? *

Are you eligible and legally able to work in the United States? *

Are you at least 18 years of age? *

Are you currently, or have you ever been, excluded from, debarred or otherwise ineligible to participate in state or federally funded programs (“Government Programs”) or federal healthcare programs as defined in 42 USC § 1320a-7b(f) (“Federal Programs”)? *

I understand that if I receive an offer of employment from Cohere Health that a background check that includes a criminal background check will be performed on my behalf. *

I HAVE READ THE CERTIFICATION ABOVE AND UNDERSTAND AND AGREE TO ITS TERMS. Please type your name and the date. *

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Cohere Health’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Gender

Are you Hispanic/Latino?

Please identify your race

Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Veteran Status

Voluntary Self-Identification of Disability

Form CC-305

Page 1 of 1

OMB Control Number 1250-0005

Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

Alcohol or other substance use disorder (not currently using drugs illegally)
Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
Blind or low vision
Cancer (past or present)
Cardiovascular or heart disease
Celiac disease
Cerebral palsy
Deaf or serious difficulty hearing
Diabetes
Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
Epilepsy or other seizure disorder
Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
Intellectual or developmental disability
Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
Missing limbs or partially missing limbs
Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
Partial or complete paralysis (any cause)
Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
Short stature (dwarfism)
Traumatic brain injury

Disability Status

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.

Enter the verification code sent to to confirm you are not a robot, then submit your application.

Security Code *

This application was flagged as potential bot traffic. To resubmit your application, turn off any VPNs, clear the browser's cache and cookies, or try another browser. If you still can't submit it, contact our support team through the help center.