Cybersecurity Analyst II

• Monitor triage investigate and respond to security alerts from Rapid7 SIEM CrowdStrike EDR cloud identity network and endpoint telemetry sources.
• Lead or coordinate incident response activities including validation containment eradication recovery root-cause analysis evidence preservation and post-incident reporting.
• Maintain and test incident response playbooks escalation procedures communications and tabletop exercises; participate in after-hours response when needed.
• Administer and optimize CrowdStrike Falcon including sensor health prevention policies detections exclusions endpoint isolation and response workflows.
• Administer and continuously improve Rapid7 SIEM including log-source onboarding parsing dashboards use cases correlation rules alert tuning retention and event investigations.
• Define and enforce security baselines for Windows macOS and Linux endpoints including patching encryption local privilege application controls secure configuration and device hygiene.
• Conduct threat hunting across accounts endpoints and network segments; incorporate relevant threat intelligence and MITRE ATT&CK techniques into defensive operations.
• Perform vulnerability assessments and risk-based prioritization; partner with system owners to remediate findings verify closure document exceptions and report remediation metrics and trends.
• Coordinate internal and third-party penetration testing scope testing activities evaluate findings and drive remediation to closure.
• Design deliver and track semiannual security awareness training phishing simulations policy refreshers and role-based materials; serve as a resource for employee security questions.

• Bachelors degree in cybersecurity computer science information systems engineering or a related discipline required and a minimum of one year hands-on cybersecurity experience with expertise in security operations incident response endpoint security SIEM vulnerability management; or an equivalent combination of education and experience.
• Demonstrated experience with CrowdStrike Falcon administration and/or Rapid7 InsightIDR platforms or comparable enterprise EDR or SIEM. This experience includes onboarding log sources developing and tuning detections managing policies and sensors and conducting investigations; direct experience with both platforms strongly preferred.
• Experience securing Windows macOS and Linux endpoints and applying hardening baselines patching encryption privilege-management and endpoint-management controls.
• Working knowledge of network cloud and identity security fundamentals including TCP/IP DNS IAM multifactor authentication single sign-on privileged access firewalls and secure logging.
• Experience with threat hunting incident response vulnerability scanning risk-based remediation penetration-test coordination and validation of corrective actions.
• Experience supporting the development of security policies and procedures and delivering security awareness training and phishing simulations to a broad employee population.
• Familiarity with NIST Cybersecurity Framework CIS Controls and Benchmarks MITRE ATT&CK and common security operations and incident response practices.
• Experience supporting SOC 2 readiness or attestation including control implementation evidence collection audit coordination and remediation preferred.
• Experience in medical devices life sciences healthcare or another regulated industry strongly preferred.
• Experience with connected medical devices IoT sensors or product security - including FDA cybersecurity expectations threat modeling SBOMs secure update and patching practices and product vulnerability disclosure - is a plus.
• Relevant security certifications and scripting or automation experience with PowerShell Python or similar tools preferred.

The use of external recruiters/staffing agencies requires prior approval from our Human Resources Department. The Human Resources Department at Imperative Care requests that external recruiters/staffing agencies not to contact Imperative Care employees directly in an attempt to present candidates. Complying with this request will be a factor in determining future professional relationships with Imperative Care.

Imperative Care will not accept unsolicited resumes from any source other than candidates themselves for either current or future positions. Submission of unsolicited resumes in advance of an agreement between the Human Resources Department and the external recruiter/staffing agency does not create any implied obligation on the part of Imperative Care.