Incident Response Analyst I

About the Role

• Investigates security incidents.
• Recommends enhancements to improve security.
• Identifies common attack patterns targeting the organization's externally facing assets.
• Contributes to the implementation of scalable and preventative security measures.
• Assists with the execution of the enterprise Incident Response Plan.
• Supports enterprise-wide remediation efforts coordinated by DFIR.
• Contributes to briefings and reporting for leadership.

Key Responsibilities

• Triages and investigates security alerts, events, and notifications end to end across endpoint, email, identity, and network telemetry according to agreed alert priority levels.
• Escalates confirmed or suspected incidents to DFIR in accordance with defined escalation criteria.
• Analyzes reported and detected phishing and malicious email to determine disposition.
• Documents investigation steps, findings, and dispositions in the case management system.
• Executes approved containment actions, such as indicator of compromise (IOC) blocking and host isolation.
• Identifies detection tuning and automation opportunities to reduce manual effort.
• Supports the review of security configurations on Centene’s production information systems and networks when gaps are identified during investigations.
• Assists with the prevention and resolution of security breaches and ensures incident and response management processes are initiated.
• Assists with access authorization reviews and access controls validation when required to support security investigations.
• Contributes to the development of automated scripts, response playbooks, and other programmed responses which are launched when an attack against Centene’s systems has been detected.
• Collaborates with Information Security Architects, Information Security Engineers, and software or hardware stakeholders.
• Integrates third-party attack monitoring services and threat reporting services into internal CIRT communications systems.
• Performs other duties as assigned.
• Complies with all policies and standards.

Requirements & Tech Stack

Baseline Skills

• Networking fundamentals (e.g., TCP/IP, DNS, HTTP) and network and infrastructure technologies, including routers, switches, and firewalls.
• Windows and Linux operating system fundamentals.
• Log analysis and investigation of security events.
• Knowledge of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) used by threat actors.

Preferred Skills

• Hands-on familiarity with endpoint detection and response (EDR) tools (e.g., CrowdStrike, Microsoft Defender for Endpoint).
• Hands-on familiarity with SIEM platforms and query languages (e.g., Splunk SPL, KQL, SQL).
• Familiarity with email security platforms (e.g., Proofpoint) and phishing analysis.
• Familiarity with the MITRE ATT&CK framework.
• Basic scripting (e.g., PowerShell, Python).

Qualifications

• A Bachelor's degree in a quantitative or business field (e.g., statistics, mathematics, engineering, computer science).
• Or equivalent experience acquired through accomplishments of applicable knowledge, duties, scope and skill reflective of the level of this position.
• Or completion of a Centene-sponsored emerging talent program.

Soft Skills

• Beginner - Seeks to acquire knowledge in area of specialty.
• Beginner - Ability to identify basic problems and procedural irregularities, collect data, establish facts, and draw valid conclusions.

License/Certification (Preferred but not required)

• CompTIA Security+
• Microsoft SC-200
• AWS Certified Cloud Practitioner
• ISC2 CC

Other Information

• Must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future.
• Sponsorship and future sponsorship are not available for this opportunity, including employment-based visa types H-1B, L-1, O-1, H-1B1, F-1, J -1, OPT, or CPT.
• Pay Range: $30.58 - $55.09 per hour.