Vacancy expired!
Resp & Qualifications
COMPANY SUMMARY:CareFirst, Inc., and its affiliated companies, generally referred to as CareFirst BlueCross BlueShield (CareFirst), is the Mid-Atlantic region’s largest private sector health insurer, serving the healthcare needs of 3.5 million members in Maryland, the District of Columbia, and portions of northern Virginia. The Company offers a comprehensive portfolio of products and services to individuals and groups, as well as state and federal government sponsored plans. With a market share almost three times that of the closest competitor, the company commands 45 percent penetration across the region. In July 2018, Brian D. Pieninck assumed the role of President and CEO after serving as the company’s COO of Strategic Business Units and IT Division. Under his leadership, the organization completed an extensive review of its operations and clinical programs, resulting in an expansive 3-year strategy to grow and diversify the company’s core business. Along with a 5-year vision to drive the transformation of the healthcare experience across the continuum of its members, partners, and communities, the company has placed a renewed and intentional focus on fostering a mission-based culture, which drives every decision the company makes. The organization employs over 5,600 full-time employees in Maryland, Northern Virginia, the District of Columbia, and West Virginia. CareFirst has earned multiple workplace awards recognizing its leadership in diversity and inclusion, wellness engagement, and creation of a supportive and equitable work environment for all employees.At CareFirst, you are part of an inspired, collaborative team that is building the healthcare experience we want for our families and our future. Every day, we make a meaningful difference in the communities where we live and work.We practice empathy, seek to understand, invest in inclusion, demand equity and nurture belonging every day for our employees and the communities we serve. We rely on the rich diversity of our employees’ experiences and backgrounds to achieve our mission. Every year we host a Week of Equity and Action where we deepen our investment and commitment to diversity, equity, and inclusion. During this week thousands of employees engage in workshops and volunteerism with the goal of bettering themselves and our community.- Women make up around 70% of CareFirst’s employee population, and over 50% identify as BIPOC (Black, Indigenous, and people of color).
- We have 9 resource groups that connect employees over shared identities (LGBTQ, veteran status, race, etc.) and passions (climate change, healthy living, leadership development).
- Employees are encouraged to give back and volunteer in their communities with their civic engagement hours.
- Dedicated monitoring and analysis of CyberSecurity events.
- Audit and review system reports and security logs for unauthorized access, noncompliant activity, or access misuse.
- Monitor and escalate incoming security requests and events of interest from different external and internal sources.
- Develop use-cases for monitoring various aspects of security infrastructure and applications.
- Clearly and accurately document observations. Process incident communications to include initial reporting, follow-ups, requests for information and resolution activity.
- Follow standard operating procedures for detecting, classifying, and reporting incidents.
- Triage (determine scope, severity, and priority) of offenses and events in Security Information and Event Management (SIEM) tool or within other security monitoring tools directly.
- Research vulnerabilities in applications and systems. Provide recommendations for resolution and track remediation activities.
- Traffic analysis (at the packet level) and reconstruction of network traffic to discover anomalies, trends, and patterns affecting the customer's networks
- Monitor mailboxes to detect and analyze phishing attacks as well as any suspicious outbound messages.
- Analyze firewall logs, Full Packet Capture (PCAP), IDS alerts, Anti-malware alerts, Host Intrusion Prevent System (HIPS), and server and application logs to investigate events and incidents for anomalous activity and produce reports of findings.
- Minimum 5 years of demonstrated work experience. (Additional experience may be required).
- Specialized training (preferred, but not required): Transitioning, maintaining, or using security technologies such as Security Incident and Event Management (SIEM), Endpoint protection, Data Loss Prevention, Forensic tools, Network Anomaly Detection, Packet Capture Analysis; Incident response principles or related technical domain that is applied in the context of a broader understanding of CSIRT and related systems and processes.
- GCIA (GIAC Certified Intrusion Analyst).
- GCIH (GIAC Certified Incident Handler) Or the ability to obtain one certification within 6 months.
- Must be able to effectively work in a fast-paced environment with frequently changing priorities, deadlines, and workloads that can be variable for long periods of time. Must be able to effectively communicate.
- Incumbent must have a firm understanding of Information and/or CyberSecurity principles. Must be able to adapt quickly to understand rapidly changing threat landscape to correctly scope and prioritize security events. The incumbent must also be able to achieve certification across multiple domains such as incident handling, web application security, etc.
- Ability to analyze security events and threats.
- Ability to document clearly and concisely the investigative, containment and resolution process for each event.
- Perform event triage to include scoping, urgency, and potential impact, identification of the exposure and recommendations for remediation.
- Lead investigation and remediation processes with stakeholders, technical and non-technical.
- Experience configuring, monitoring, and responding to alerts from EDR tools.
- Experience with analyzing large data sets and log files to find correlations and anomalies.
- Working knowledge of multiple operating systems and system administration skills.
- Strong knowledge of client-server applications, multi-tier web applications, relational databases, firewalls, VPNs, etc.
- Experience with security monitoring and reporting tools and conducting security investigations of incidents and events.
- Ability to utilize native cloud security tools to design and implement continuous monitoring solutions.
- Advanced knowledge and use of Splunk to create complex queries for event investigations.
- In depth understanding of MS Defender for M365 security, Defender for Endpoint, Defender for Cloud, etc.
- Advanced knowledge and use of Linux.
- Cloud Security Detection and Response.
- SOAR/Automation technology.
- Experience with scripting, automation and/or programming: Python, PowerShell, Ansible, other orchestration tools, or equivalent.
- ID: #44724066
- State: Maryland Owingsmills 21117 Owingsmills USA
- City: Owingsmills
- Salary: USD TBD TBD
- Job type: Permanent
- Showed: 2022-08-09
- Deadline: 2022-10-07
- Category: Et cetera