This job was posted by https://illinoisjoblink.illinois.gov : For more
information, please see:
https://illinoisjoblink.illinois.gov/jobs/13715142
Job Description:
Incident Response Analyst
Location:Remote
Pay Rate: $55-60/hr based on experience
Duration: 6+ months contract
Role Overview
An Incident Response Analyst is sought to join a co-sourced cyber
operations environment. In this setting, an external managed security
service provider handles primary SOC monitoring, and the internal team
manages escalated investigations through to remediation. This position
will provide operational coverage, investigate security events,
coordinate response activities across technical teams, and strengthen
vulnerability management and data loss prevention capabilities.
Key Responsibilities
Receive escalated alerts and tickets from the SOC, initiate
investigations, determine scope and impact, and manage incidents
through remediation and closure.
Investigate malware, phishing, unexpected network connections, and
other security events by reviewing SIEM logs, endpoint telemetry,
affected assets, and impacted users.
Coordinate with infrastructure, application, clinical technology,
privacy, and other internal teams to contain threats and execute
corrective actions.
Participate in the rotating SOC alert and on-call coverage model.
Execute and improve established incident response runbooks and
support the continued development of operational procedures.
Use packet capture data at network egress points to trace threats
and support response actions that require internal access or
credentials.
Create, tune, and maintain custom detections and response scripts
within the co-sourced security model.
Support vulnerability management operations by researching newly
disclosed CVEs, identifying affected assets, validating exposure,
and assisting in the prioritization of remediation.
Account for systems that may not appear in standard vulnerability
tools, such as medical and other specialized devices, when assessing
exposure.
Review DLP alerts and policies, investigate potential data exposure
events, and coordinate escalation to the privacy team when events
may involve PHI or patient impact.
Document investigations, response actions, findings, and remediation
activities in ServiceNow in alignment with ITIL-based processes.
Required Qualifications
Approximately 5-10 years of relevant cybersecurity operations
experience, with hands-on incident response and SOC escalation
responsibility.
Demonstrated ability to independently investigate alerts, build a
complete picture from multiple data sources, and coordinate an
incident through remediation.
Experience reading and interpreting SIEM logs; Sumo Logic experience
is preferred.
Hands-on experience with CrowdStrike for endpoint investigation,
threat response, exposure research, and detection or response
scripting.
A solid foundation in vulnerability management, including practical
experience assessing CVEs, identifying affected assets, interpreting
scanner findings, and prioritizing remediation.
Experience with vulnerability management platforms such as Tenable
Nessus and Qualys; direct Tenable experience is preferred.
Experience investigating DLP events and understanding how DLP
policies trigger; Microsoft Purview experience is preferred.
Working knowledge of ITIL practices and experience using ServiceNow
for security operations workflows and ticket management.
Clear communication, sound judgment, and the ability to work
effectively across technical and business teams during active
investigations.
Preferred Qualifications
Experience in a healthcare environment or with security events
involving PHI, medical devices, or patient-impacting systems.
Deep vulnerability management expertise and the ability to improve
prioritization practices, recommend better operating approaches, and
share knowledge with other team members.
Experience working in an operational security function where
workload shifts based on active incidents and emerging threats.
Experience authoring custom detections and developing scripts that
automate or accelerate threat response.
Everforth Apex is a world-class IT services company that serves
thousands of clients across the globe. When you join Everforth Apex, you
become part of a team that values innovation, collaboration, and
continuous learning. We offer quality career resources, training,
certifications, development opportunities, and a comprehensive benefits
package. Our commitment to excellence is reflected in many awards,
including ClearlyRateds Best of Staffing in Talent Satisfaction in the
United States and Great Place to Work in the United Kingdom and Mexico.
Everforth Apex uses a virtual recruiter as part of the application
process.
Clickhere{target="_blank"
rel="noopener"}for more de
