Senior Security Threat Engineer

The Senior Threat Response Engineer is an individual contributor responsible for investigating and responding to security events. The engineer leads complex investigations from initial triage through scoping, evidence collection, containment, remediation, documentation, and stakeholder communication. The role requires strong judgment when information is incomplete and the ability to develop clear, supportable conclusions from endpoint, identity, network, web, email, cloud, and other security telemetry.

This role also serves as a technical owner and subject matter expert for forensic tooling and endpoint agents. The engineer will help operate and improve tooling, support deployments and vendor coordination, develop investigative workflows, and transfer knowledge across the team. Successful candidates can take an ambiguous problem, determine what evidence is needed, and drive the work to a defensible conclusion., * Triage security detections and reports, distinguish expected activity from credible threats, and provide clear containment and remediation recommendations.

• Perform Windows artifact and forensic analysis, including program execution, file and account activity, persistence, memory, and other endpoint evidence; familiarity with Linux and macOS investigation is helpful.
• Perform digital forensics and incident response across endpoint, identity, network, web, email, and cloud telemetry; build timelines, correlate evidence, determine root cause, and document supportable conclusions.
• Maintain appropriate evidence handling, case documentation, confidentiality, and ethical use of security tools and sensitive data.
• Communicate findings, uncertainty, risk, and recommendations to technical and non-technical stakeholders, including leadership, Legal, Risk/Governance, Human Resources, Ethics & Compliance, and other partners as appropriate.
• Partner with Security Engineering, Identity and Access Management, Networking, Endpoint, Vulnerability/Patching, Threat Intelligence, and other teams to investigate and remediate threats.
• Improve detection and investigation procedures through threat hunting, runbook development, post-incident lessons learned, and feedback to security tooling and engineering teams.
• Mentor and onboard analysts, lead knowledge-sharing sessions, and support technical evaluation and interviewing as requested.

• Five or more years of relevant experience in any of the following domains: cyber incident response, digital forensics, threat response, insider threat, security operations.
• Experience with Endpoint Detection and Response (EDR) platforms such as Microsoft Defender for Endpoint or comparable tools.
• Experience performing security analysis with Security Information and Event Management (SIEM) technologies; Splunk and SPL experience are preferred.
• Experience deploying, tuning, or operating security tools and working directly with vendors to improve investigative capabilities.

RELEVANT WORK EXPERIENCE

• 5+ years

EDUCATION

• Bachelor’s Degree Preferred

OTHER/SPECIAL QUALIFICATIONS

The successful candidate will possess the following aptitudes and skillsets:

• Sound investigative judgment and the discipline to separate established facts, reasonable inference, and unresolved questions.
• Ability to lead incident response and investigative work calmly and professionally under time pressure.
• Strong written and verbal communication skills, including the ability to explain technical findings and risk to non-technical stakeholders.
• Ability to maintain confidentiality, handle sensitive data appropriately, and follow ethical practices when using investigative tools and accessing data.
• Ability to prioritize work based on business impact, criticality, and threat level while maintaining clear case documentation.
• Ability to mentor teammates, share technical knowledge, and contribute to the development of team capabilities.

Helpful certifications and courses (not required):

• GIAC GCIH, GCFA, GNFA, GCIA, GMON, CISSP, or comparable credentials.

HCA Healthcare, offers a total rewards package that supports the health, life, career and retirement of our colleagues. The available plans and programs include:

• Comprehensive benefits for medical, prescription drug, dental, vision, behavioral health and telemedicine services
• Wellbeing support, including free counseling and referral services
• Time away from work programs for paid time off, paid family leave, long- and short-term disability coverage and leaves of absence
• Savings and retirement resources , including a 401(k) Plan with a 100% match on 3% to 9% of pay (based on years of service), Employee Stock Purchase Plan, flexible spending accounts, preferred banking partnerships, retirement readiness tools, rollover support and financial wellbeing counseling
• Education support through tuition assistance, student loan assistance, certification support, dependent scholarships and a partnership with Galen College of Nursing
• Additional benefits for fertility and family building, adoption assistance, life insurance, supplemental health protection plans, auto and home insurance, legal counseling, identity theft protection and consumer discounts

Learn more about Employee Benefits (https://careers.hcahealthcare.com/pages/employee-benefits-and-rewards)

HCA Healthcare has been recognized as one of the World’s Most Ethical Companies® by the Ethisphere Institute more than ten times. In recent years, HCA Healthcare spent an estimated $3.7 billion in cost for the delivery of charitable care, uninsured discounts, and other uncompensated expenses.

“There is so much good to do in the world and so many different ways to do it.”- Dr. Thomas Frist, Sr.