Incident Response Analyst I at Centene Corporation

Job description

Position Purpose: Investigates security incidents, recommends enhancements to improve security, identifies common attack patterns targeting the organization s externally facing assets, and contributes to the implementation of scalable and preventative security measures. Assists with the execution of the enterprise Incident Response Plan. Supports enterprise-wide remediation efforts coordinated by DFIR and contributes to briefings and reporting for leadership. Key Details: Must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future. Sponsorship and future sponsorship are not available for this opportunity, including employment-based visa types H-1B, L-1, O-1, H-1B1, F-1, J -1, OPT, or CPT. Triages and investigates security alerts, events, and notifications end to end across endpoint, email, identity, and network telemetry according to agreed alert priority levels, and escalates confirmed or suspected incidents to DFIR in accordance with defined escalation criteria. Analyzes reported and detected phishing and malicious email to determine disposition. Documents investigation steps, findings, and dispositions in the case management system. Executes approved containment actions, such as indicator of compromise (IOC) blocking and host isolation. Identifies detection tuning and automation opportunities to reduce manual effort. Supports the review of security configurations on Centene’s production information systems and networks when gaps are identified during investigations. Assists with the prevention and resolution of security breaches and ensures incident and response management processes are initiated. Assists with access authorization reviews and access controls validation when required to support security investigations. Contributes to the development of automated scripts, response playbooks, and other programmed responses which are launched when an attack against Centene’s systems has been detected. Collaborates with Information Security Architects, Information Security Engineers, and software or hardware stakeholders at Centene. Integrates third-party attack monitoring services and threat reporting services into internal CIRT (Cyber Incident Response Team) communications systems. Performs other duties as assigned. Complies with all policies and standards. Education/Experience: A Bachelor s degree in a quantitative or business field (e.g., statistics, mathematics, engineering, computer science) and requires 0 – 2 years of related experience. Or equivalent experience acquired through accomplishments of applicable knowledge, duties, scope and skill reflective of the level of this position. Or completion of a Centene-sponsored emerging talent program. Technical Skills: Skills may be gained through academic, lab, internship, or professional experience. Baseline: Networking fundamentals (e.g., TCP/IP, DNS, HTTP) and network and infrastructure technologies, including routers, switches, and firewalls. Windows and Linux operating system fundamentals. Log analysis and investigation of security events. Knowledge of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) used by threat actors. Preferred: Hands-on familiarity with endpoint detection and response (EDR) tools (e.g., CrowdStrike, Microsoft Defender for Endpoint). Hands-on familiarity with SIEM platforms and query languages (e.g., Splunk SPL, KQL, SQL). Familiarity with email security platforms (e.g., Proofpoint) and phishing analysis. Familiarity with the MITRE ATT&CK framework. Basic scripting (e.g., PowerShell, Python). Soft Skills: Beginner - Seeks to acquire knowledge in area of specialty. Beginner - Ability to identify basic problems and procedural. irregularities, collect data, establish facts, and draw valid conclusions. License/Certification: CompTIA Security , Microsoft SC-200, AWS Certified Cloud Practitioner, ISC2 CC preferred but not required. Pay Range: $30.58 - $55.09 per hour At Centene, we connect people to the care they need to live healthier lives — and the work you do here makes that impact real every day. You’ll take on meaningful challenges that directly support individuals, families, and communities, building your skills while making healthcare more accessible and effective. It’s work with a purpose you can see, backed by a team committed to improving lives well beyond the workday. Centene offers a comprehensive benefits package including: competitive pay, health insurance, 401K and stock purchase plans, tuition reimbursement, paid time off plus holidays, and a flexible approach to work with remote, hybrid, field or office work schedules. Actual pay will be adjusted based on an individual s skills, experience, education, and other job-related factors permitted by law , including full-time or part-time status. Total compensation may also include additional forms of incentives. Benefits may be subject to program eligibility. Centene is an equal opportunity employer that is committed to diversity, and values the ways in which we are different. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or other characteristic protected by applicable law. Qualified applicants with arrest or conviction records will be considered in accordance with the LA County Ordinance and the California Fair Chance Act

Requirements

Must-haves

Analyzes reported and detected phishing and malicious email to determine disposition.
Documents investigation steps, findings, and dispositions in the case management system.
Executes approved containment actions, such as indicator of compromise (IOC) blocking and host isolation.
Identifies detection tuning and automation opportunities to reduce manual effort.
Supports the review of security configurations on Centene’s production information systems and networks when gaps are identified during investigations.
Assists with the prevention and resolution of security breaches and ensures incident and response management processes are initiated.
Assists with access authorization reviews and access controls validation when required to support security investigations.
Contributes to the development of automated scripts, response playbooks, and other programmed responses which are launched when an attack against Centene’s systems has been detected.
Collaborates with Information Security Architects, Information Security Engineers, and software or hardware stakeholders at Centene.
Integrates third-party attack monitoring services and threat reporting services into internal CIRT (Cyber Incident Response Team) communications systems.
Performs other duties as assigned.
Complies with all policies and standards.
Education/Experience: A Bachelor s degree in a quantitative or business field (e.g., statistics, mathematics, engineering, computer science) and requires 0 – 2 years of related experience.
Or equivalent experience acquired through accomplishments of applicable knowledge, duties, scope and skill reflective of the level of this position. Or completion of a Centene-sponsored emerging talent program.
Skills may be gained through academic, lab, internship, or professional experience.
Networking fundamentals (e.g., TCP/IP, DNS, HTTP) and network and infrastructure technologies, including routers, switches, and firewalls.
Windows and Linux operating system fundamentals.
Log analysis and investigation of security events.

Nice-to-haves

Hands-on familiarity with endpoint detection and response (EDR) tools (e.g., CrowdStrike, Microsoft Defender for Endpoint).
Hands-on familiarity with SIEM platforms and query languages (e.g., Splunk SPL, KQL, SQL).
Familiarity with email security platforms (e.g., Proofpoint) and phishing analysis.
Familiarity with the MITRE ATT&CK framework.
Basic scripting (e.g., PowerShell, Python).
CompTIA Security , Microsoft SC-200, AWS Certified Cloud Practitioner, ISC2 CC preferred but not required.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

sqlpythonaws

Platform: workday
Effort: long

Benefits

Benefits detected in the listing.

Health Insurance

401k

Paid Time Off