Note: The job is a remote job and is open to candidates in USA. UChicago Medicine is one of the nation’s most comprehensive academic medical centers, and they are seeking an Information Security Engineer – Security Automation and Response for the Information Security department. The role involves implementing and optimizing automation for security operations, participating in threat investigation, and enhancing incident response capabilities.
Responsibilities
- Develop, implement, and maintain SOAR playbooks to automate repetitive security tasks, such as alert triage, threat investigation, and incident response, using tools like SOAR, Python, and API integrations
- Knowledge of threat detection development, automation of SOAR development, and Incident Response
- Support initiatives working with Information Security Operations Manager to advance Security Operations capabilities using AI
- Investigate malware, intrusions, unauthorized access, and data infiltration and exfiltration events
- Analyze logs, memory, disk images, and network captures to determine attack scope and impact
- Dedicate efforts to staying informed on cyber threats and standard processes to consistently enhance Security Operations Center capabilities
- Excellent knowledge of security information and event management (SIEM) platforms including query language (Yara-L, CQL, SPL, etc.)
- Participate in Purple Team activity
- Participate in on-call rotation and respond to critical security events
Skills
- BS or BA degree, Computer Science, Engineering, or equivalent education, training or work experience
- 5 years of Security experience, or equivalent training and education
- Knowledge of computing systems, data network communications, and network architecture
- Effective written and verbal communication skills
- Experience in SOAR playbook development
- Scripting or programming skills (Python, PowerShell, Go, etc.) required
- Experience in Incident Response and Threat investigation
- Experience in Threat detection
- Understanding of logging systems
- Security related certifications are preferred. (GIAC, CISSP)
Company Overview
Company H1B Sponsorship