Senior Security Engineer, Incident Response

Driven by our mission to make it easier to understand, navigate, and pay for healthcare, Collective Health is evolving the way health benefits work. If you are passionate about our mission and you are an experienced hands-on product and application security professional who is excited about developing and leading a broad range of functions at a mission-driven, highly-regulated technology company, this role is for you.

You’ll lead initiatives that address the company’s—and some of our industry’s—most sophisticated and meaningful security and architectural challenges. You will build relationships across all parts of the business and drive multi-functional initiatives to continuously improve our security and privacy posture. You will be responsible for building and implementing controls that can scale and optimize as we move into a context-aware security environment.

This position is a hands-on role as a cyber security incident first- responder. An Incident Responder will provide a rapid initial response to any cyber security threats, incidents or cyber attacks on the organization. The responder will utilize a suite of forensic tools to enable investigations on any issues as they develop. Once the cause of the problem has been identified, you will need to restrict any damage, provide immediate workarounds, work with corporate communications, engineering, etc and if possible provide a solution or fix, so that any intrusion or threat to the organization is negated rapidly. Prepare and practice IR plans, perform tabletop exercises, etc. When not actively responding to incidents, you will proactively identify, research, and prioritize threats and associated threat actors. 

What you'll do:

• Assist in developing annual strategy in Incident Response
• Conduct time-sensitive threat analysis
• Triage high visibility incidents and report findings to senior leadership
• Work closely with cross-functional teams to resolve cyber related issues, by providing detailed explanations of the incidents and necessary remediations
• Assist in the development, implementation, and monitoring of a SIEM
• Oversee remediation activities related to remediation of exploited system security vulnerabilities
• Maintain the Incident Response Policy and Incident Playbooks
• Assist in special projects and recommendations for technical security solutions that align with the department’s vision and the needs of the business
• Facilitate annual tabletop activities and conduct technical level and business discussions, as it relates to incident response, cyber forensics, and threat analytics
• Be an active part of a 24/7/365 cyber incident response team
• Collaborate with team members, understand their processes and workflows, prioritize their ideas and innovations and develop improvements to ensure successful execution
• Educate both security and non-security user groups on security topics
• Design security processes to ensure compliance to security policies as well as regulatory compliance (HIPAA, HITRUST, SOC 2, etc.). Assist with gathering audit evidence.

To be successful in this role, you'll need:

• Strong experience in managing incident response and forensic tools
• Strong experience in performing threat assessments, determining what data is applicable to an industry vertical, and reporting on those findings
• Basic to moderate experience with common attack scenarios in various common layers within enterprise infrastructure (cloud-based issues, code quality, insider threat, etc.,)
• Moderate experience with socializing and building partnership on security programs and user expectations
• Moderate experience with training and mentoring the entire company on security
• Familiarity with security industry standards (ISO 17799, NIST 800 series, etc.) and best practices
• Experience developing threat indicators to be used to develop correlated SIEM alerts
• Understanding of common cyber attack and defense frameworks such as MITRE, NIST 800-61r2.

Pay Transparency Statement 

This is a hybrid position based out of one of our offices: San Francisco, CA, Plano, TX, or Lehi, UT. Hybrid employees are expected to be in the office three days per week (Plano, TX) or two days per week (San Francisco, CA and Lehi, UT).#LI-hybrid

The actual pay rate offered within the range will depend on factors including geographic location, qualifications, experience, and internal equity. In addition to the salary, you will be eligible for stock options and benefits like health insurance, 401k, and paid time off. Learn more about our benefits at https://jobs.collectivehealth.com/benefits/.