Note: The job is a remote job and is open to candidates in USA. UChicago Medicine is one of the nation’s most comprehensive academic medical centers, and they are seeking an Information Security Engineer – Security Automation and Response for their Information Security department. The role involves implementing and optimizing automation for security operations, participating in threat investigations, and enhancing the capabilities of the Security Operations Center.
Responsibilities
- Develop, implement, and maintain SOAR playbooks to automate repetitive security tasks, such as alert triage, threat investigation, and incident response, using tools like SOAR, Python, and API integrations
- Knowledge of threat detection development, automation of SOAR development, and Incident Response
- Support initiatives working with Information Security Operations Manager to advance Security Operations capabilities using AI
- Investigate malware, intrusions, unauthorized access, and data infiltration and exfiltration events
- Analyze logs, memory, disk images, and network captures to determine attack scope and impact
- Dedicate efforts to staying informed on cyber threats and standard processes to consistently enhance Security Operations Center capabilities
- Excellent knowledge of security information and event management (SIEM) platforms including query language (Yara-L, CQL, SPL, etc.)
- Participate in Purple Team activity
- Participate in on-call rotation and respond to critical security events
Skills
- BS or BA degree, Computer Science, Engineering, or equivalent education, training or work experience
- 5 years of Security experience, or equivalent training and education
- Knowledge of computing systems, data network communications, and network architecture
- Effective written and verbal communication skills
- Experience in SOAR playbook development
- Scripting or programming skills (Python, PowerShell, Go, etc.) required
- Experience in Incident Response and Threat investigation
- Experience in Threat detection
- Understanding of logging systems
- Security related certifications are preferred. (GIAC, CISSP)
Company Overview