|
The Cybersecurity Analyst is an early-career, hands-on member of the CEENTA Information Technology team responsible for supporting daily cybersecurity operations, security monitoring, incident triage, documentation, risk and compliance activities, and end-user security support. The role works under the direction of the Cybersecurity Engineer and supports protection of CEENTA’s information assets, clinical and business systems, Microsoft 365 environment, endpoints, network infrastructure, applications, and sensitive data, including electronic protected health information (ePHI). The Analyst follows established policies, runbooks, and documented procedures; maintains accurate records of findings and actions; collaborates with IT and business stakeholders; and escalates complex, high-risk, or policy-level decisions to the Cybersecurity Engineer or IT leadership.
|
|
Daily Security Operations, Monitoring, and Response (approximately 65% to 70% of role)
- Monitor, triage, and document alerts from SIEM, EDR/XDR, email security, identity, endpoint, cloud, and web filtering platforms in accordance with documented procedures.
- Perform initial investigation of reported phishing, suspicious user activity, endpoint alerts, unusual authentication activity, malware indicators, and other security events.
- Escalate confirmed, complex, or high-risk incidents to the Cybersecurity Engineer with clear evidence, timelines, impact notes, and recommended next steps.
- Administer day-to-day security platform activities such as email quarantine review, allow/block list requests, sender/recipient policy exceptions, web filtering exceptions, MFA support, EDR health checks, and security queue management.
- Assist with Microsoft security and identity operations, including Microsoft 365, Entra ID, Defender, Conditional Access support, audit log review, and related security control validation as assigned.
- Execute or support vulnerability scans, create remediation tickets, track ownership and due dates, validate remediation, and escalate overdue or high-risk findings.
- Coordinate with Help Desk, Infrastructure, Network, Application, and vendor teams on security-related tickets, endpoint remediation, access questions, change activities, and incident follow-up.
- Maintain accurate case notes, incident records, metrics, SOPs, runbooks, and knowledge base articles to support audit readiness, continuity, and repeatable operations.
- Support tabletop exercises, incident response testing, phishing simulations, and operational improvement activities led by the Cybersecurity Engineer.
Risk, Compliance, Governance, and Program Support (approximately 30% to 35% of role)
- Support HIPAA Security Rule, privacy, cyber insurance, internal audit, external audit, and other regulatory or contractual cybersecurity evidence requests.
- Assist with vendor risk management intake, initial review, documentation collection, questionnaire review, SOC 2/HITRUST/BAA tracking, and summary reporting for Cybersecurity Engineer review.
- Help maintain risk registers, exception logs, remediation trackers, policy inventories, security control documentation, and management reporting artifacts.
- Assist with user access reviews, privileged access recertifications, control testing, and evidence organization in approved CEENTA repositories.
- Support cybersecurity awareness activities, including phishing education, new-hire security orientation, newsletters, targeted end-user coaching, and security reminders.
- Research emerging threats, vulnerabilities, healthcare cybersecurity risks, and best practices; summarize relevant findings for the Cybersecurity Engineer and IT leadership.
- Participate in cybersecurity projects, technology implementations, change reviews, and continuous improvement initiatives as assigned.
|
|
- Foundational understanding of cybersecurity principles, including confidentiality, integrity, availability, least privilege, defense in depth, phishing, malware, social engineering, credential compromise, and common incident response concepts.
- Working familiarity with Microsoft 365, Windows endpoints, Active Directory / Microsoft Entra ID, MFA, endpoint protection, email security, ticketing systems, and common enterprise IT operations.
- Operational awareness of SIEM, EDR/XDR, email security, vulnerability management, web filtering, identity security, privileged access, and cloud security tooling.
- Ability to follow documented procedures, analyze alerts and evidence, document findings clearly, and recognize when escalation is required.
- Strong written and verbal communication skills, including the ability to explain security issues to technical and non-technical audiences without unnecessary jargon.
- Excellent attention to detail, sound judgment, discretion, and commitment to confidentiality when handling patient, employee, vendor, and business information.
- Ability to manage multiple tickets, alerts, documentation requests, and deadlines in a fast-paced healthcare environment.
- Customer-service mindset and ability to work collaboratively with clinical, administrative, technical, and vendor stakeholders.
- Curiosity, coachability, and commitment to continuous development through hands-on learning, certifications, labs, and cybersecurity training.
|
