This job was posted by https://illinoisjoblink.illinois.gov : For more information, please see: https://illinoisjoblink.illinois.gov/jobs/13715142 Job Description:

Incident Response Analyst

Location:Remote

Pay Rate: $55-60/hr based on experience

Duration: 6+ months contract

Role Overview

An Incident Response Analyst is sought to join a co-sourced cyber operations environment. In this setting, an external managed security service provider handles primary SOC monitoring, and the internal team manages escalated investigations through to remediation. This position will provide operational coverage, investigate security events, coordinate response activities across technical teams, and strengthen vulnerability management and data loss prevention capabilities. Key Responsibilities Receive escalated alerts and tickets from the SOC, initiate

investigations, determine scope and impact, and manage incidents through remediation and closure.

Investigate malware, phishing, unexpected network connections, and

other security events by reviewing SIEM logs, endpoint telemetry, affected assets, and impacted users.

Coordinate with infrastructure, application, clinical technology,

privacy, and other internal teams to contain threats and execute corrective actions.

Participate in the rotating SOC alert and on-call coverage model.

Execute and improve established incident response runbooks and

support the continued development of operational procedures.

Use packet capture data at network egress points to trace threats

and support response actions that require internal access or credentials.

Create, tune, and maintain custom detections and response scripts

within the co-sourced security model.

Support vulnerability management operations by researching newly

disclosed CVEs, identifying affected assets, validating exposure, and assisting in the prioritization of remediation.

Account for systems that may not appear in standard vulnerability

tools, such as medical and other specialized devices, when assessing exposure.

Review DLP alerts and policies, investigate potential data exposure

events, and coordinate escalation to the privacy team when events may involve PHI or patient impact.

Document investigations, response actions, findings, and remediation

activities in ServiceNow in alignment with ITIL-based processes. Required Qualifications Approximately 5-10 years of relevant cybersecurity operations

experience, with hands-on incident response and SOC escalation responsibility.

Demonstrated ability to independently investigate alerts, build a

complete picture from multiple data sources, and coordinate an incident through remediation.

Experience reading and interpreting SIEM logs; Sumo Logic experience

is preferred.

Hands-on experience with CrowdStrike for endpoint investigation,

threat response, exposure research, and detection or response scripting.

A solid foundation in vulnerability management, including practical

experience assessing CVEs, identifying affected assets, interpreting scanner findings, and prioritizing remediation.

Experience with vulnerability management platforms such as Tenable

Nessus and Qualys; direct Tenable experience is preferred.

Experience investigating DLP events and understanding how DLP

policies trigger; Microsoft Purview experience is preferred.

Working knowledge of ITIL practices and experience using ServiceNow

for security operations workflows and ticket management.

Clear communication, sound judgment, and the ability to work

effectively across technical and business teams during active investigations. Preferred Qualifications Experience in a healthcare environment or with security events

involving PHI, medical devices, or patient-impacting systems.

Deep vulnerability management expertise and the ability to improve

prioritization practices, recommend better operating approaches, and share knowledge with other team members.

Experience working in an operational security function where

workload shifts based on active incidents and emerging threats.

Experience authoring custom detections and developing scripts that

automate or accelerate threat response. Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing in Talent Satisfaction in the United States and Great Place to Work in the United Kingdom and Mexico. Everforth Apex uses a virtual recruiter as part of the application process. Clickhere{target="_blank" rel="noopener"}for more de

Apex Systems

New Jobs

Incident Response Analyst