Baltimore, Maryland
Houston, Texas
Castle Point, New York, New York
Minnesota
Michigan
Posted: 29-Jan-25
Location: Durham, North Carolina
Categories:
Internal Number: 252866
At Duke Health, we're driven by a commitment to compassionate care that changes the lives of patients, their loved ones, and the greater community. No matter where your talents lie, join us and discover how we can advance health together.
About Duke Health Technology Solutions
Pursue your passion for caring and innovation with Duke Heath Technology Solutions, which is dedicated to the transformation, development, and management of enterprise information technology solutions across Duke Health. By harnessing the power of innovative technologies like cloud computing and artificial intelligence - and pairing them with a forward-thinking approach - Duke Health Technology Solutions is revolutionizing the future of health care at Duke Health and beyond.
Occupational Summary
The Information Security Analyst provides support for a variety of operational and consultative functions as part of a Duke Information Security Office (ISO). The Information Security Analyst helps design, implement, manage, and monitor technical, administrative, and physical controls to protect the confidentiality, integrity, and availability of the organization's information assets. The Information Security Analyst will carry out these responsibilities in collaboration with IT, clinical, research, and management staff from across Duke.
Duke Health Information Security Office analysts will perform work across multiple domains of information security but will have primary duties assigned specifically from analyst Working Titles.
Work Performed
This position has the Working Title of Cloud Regulatory Specialist. Duties specific to this position will primarily reside in the Governance and Risk Security Analyst domain with the primary objective of regulatory compliance documentation and assessments of NIST capabilities in a cloud setting.
Governance and Risk Security Analyst:
? Vendor risk assessment;
? Exception management;
? Security Policy management;
? Regulatory Compliance aligned with HIPAA, NIST CSF, CIS, and other security frameworks.
IAM Security Analyst:
? Assists in providing access support for the implementation and administration of IAM supported platforms to include Epic Maestro Care, Active Directory, and disconnected applications;
? Ensures IAM solutions adhere to regulatory, compliance and internal requirements;
? Provides Break/Fix and enhancement support following existing change management
? Provides guidance on the implementation and usage of IAM capabilities in enterprise systems
Penetration Test Security Analyst:
? Conduct comprehensive penetration tests and security assessments of web applications, networks, systems, and infrastructure to identify security vulnerabilities, weaknesses, and exposures;
? Perform manual and automated penetration testing techniques, including but not limited to network penetration testing, static and dynamic application security testing, and device security testing;
? Analyze and interpret penetration test results, prioritize identified vulnerabilities based on risk severity, and provide actionable recommendations for remediation;
? Collaborate with cross-functional teams, including developers, system administrators, and security engineers, to address identified security issues and implement effective security controls and measures;
? Document and report findings, recommendations, and remediation steps in clear and concise reports tailored to technical and non-technical audiences.
Vulnerability Security Analyst:
? Identify and prioritize security vulnerabilities, weaknesses, and exposures based on risk severity, impact, and exploitability;
? Analyze and interpret vulnerability scan results, including vulnerability assessment reports, scan findings, and threat intelligence feeds, to identify emerging threats and potential security issues;
? Collaborate with cross-functional teams, including system administrators, network engineers, and software developers, to address identified vulnerabilities and implement appropriate remediation measures and security controls;
? Monitor and track the progress of vulnerability remediation efforts, escalate critical issues as needed, and ensure timely resolution of identified security risks;
? Develop and maintain comprehensive documentation, including vulnerability assessment reports and standards, security policies and procedures.
Tools, Architecture and Engineering Security Analyst:
? Deploy, configure, and maintain security solutions and tools such as Endpoint Detection & Response, Web Gateway, Vulnerability Management, Data Loss Prevention, etc.;
? Act as an escalation point for issues, incidents and questions related to the security tool portfolio;
? Ensure that security tools are providing expected outcomes, and that operational process and procedure are in place to utilize tools;
? Consult with partner IT teams to assist application owners in deploying solutions securely, choosing appropriate security measures and documentation of system security plans;
? Work with other IT architects and technical leads as the primary security liaison on large IT infrastructure and application projects.
Incident Response Security Analyst:
? Analyze findings from security monitoring systems to identify and respond to potential security incidents and data breaches;
? Participate in incident response activities. Conduct forensic investigations, isolate malware, threat modelling and identify attack vectors;
? 24x7 on-call support rotation may be required.
Awareness and Training Security Analyst:
? Design and deliver awareness training for the organization's staff. Promote Security Culture activities;
? Design and deliver simulated phishing.
Business Continuity/Disaster Recovery Security Analyst:
? Coordinate completion of Business Impact Assessments (BIA), identify Recovery Time Objective (RTO) and Recovery Point Objective (RPO), and assign Criticality based on organizational priorities;
? Conduct continuity focused risk assessments with stakeholders, provide Criticality-appropriate recommendations focused on reduction of identified risks;
? Facilitate development and exercise of continuity, recovery, and restoration plans and track completion of any corrective actions identified throughout the process.
Core Competencies:
Across all analysts in the Duke Information Security Office, the following Core Competencies are established. In addition, all analysts are expected to perform other related duties incidental to the work described herein.
LEVEL 1:
? Directed work on individual tasks as assigned by manager with direct supervision, oversight, and guidance by manager;
? Assess risk and provide guidance on remediation planning using pre-established operating procedures and decision trees;
? Commitment to customer satisfaction;
? Strong written and oral communication skills;
? Attention to detail and organization.
LEVEL 2:
In addition to the duties described for the Level 1, the Level 2 will, at a minimum:
? Independent work on individual tasks and projects as assigned by manager with limited supervision, oversight, and guidance by manager;
? Assess risk and provide guidance on remediation planning using additional professional judgment and institutional knowledge. As requested by management, provide input for reports and analysis;
? Participate in activities that could have significant impact for operational, financial and/or risk improvement as directed by management;
? Lead and influence initiatives within the Duke Health ISO;
? Strong critical thinking, analytical, and problem-solving skills;
? Ongoing knowledge of latest security trends, emerging threats, and industry best practices;
? Strong interpersonal skills and the ability to build relationships with colleagues, customers, vendors, and other third parties.
LEVEL 3:
In addition to the duties described for the Level 1/2, the Level 3 will, at a minimum:
? Assess risk and provide guidance on remediation planning as a Subject Matter Expert in a specific domain or tool;
? Identify areas that could have significant impact for operational, financial and/or risk improvement and bring a developed plan to management for approval. If approved, lead execution of project;
? Represent Duke Health ISO to DHTS (Duke Health Technology Solutions) Senior Leadership Team or Duke Executive boards. Prepare and independently present reports and presentations on the status of security controls to management and technical staff;
? Mentor, guide, and provide support to management in day-to-day personnel oversight and workflow management activities and evaluation input for Level 1/2 staff performance;
? Lead and influence initiatives outside of the Duke Health ISO within the broader Duke community;
? As appropriate, participates in external professional organizations that are relevant to the objectives of the information security program;
? Utilize knowledge of latest security trends, emerging threats, and industry best practices to provide recommendations for improving system and enterprise security posture;
? Exemplary capability to communicate with technical and non-technical audiences in both formal and informal settings;
? Able to understand and translate between business and technical requirements.
Behaviors/Soft Competencies:
Advancement to the level 3 or above requires the employee, at a minimum, successfully attain the following:
The following measures can help create a fair and comprehensive evaluation process for promotions, ensuring that the most deserving employees are recognized and given opportunities to advance.
1. Proven ability to work at the next level: This involves demonstrating the skills and competencies required for the next level of responsibility. Employees should have demonstrated that they can handle tasks and challenges that are typically associated with the higher position.
2. Potential to serve beyond the next level: This measure looks at the employee's long-term potential and their ability to grow within the organization. The employee should have the vision, ambition, and capability to take on even greater responsibilities in the future.
3. Consistently demonstrates a values-based approach in how they work: Employees should consistently exhibit behaviors and decision-making processes that align with DUHS values. The exhibited values are integrity, teamwork, diversity excellence and safety. Patient-focused is also critical to success.
4. Is considered one of the top performers at their level across the organization: This measure evaluates the employee's overall performance and reputation within DHTS. Top performers are often recognized for their exceptional contributions, reliability, and ability to exceed expectations. We will select the best and not the best available.
Qualifications:
Education/Training: Level 1, 2 and 3 - Bachelor's degree in a related clinical or technical field, or four years of equivalent technical experience required.
Level 3 - A Master's degree in a related clinical or technical field is preferred.
LICENSURE/CERTIFICATION:
LEVEL 1:
Security+ or equivalent is preferred.
LEVEL 2:
In addition to the requirements described for the Level 1:
One or more information security industry certifications (e.g., CISSP, CISM, CISA, CEH, or equivalent) are preferred.
LEVEL 3:
In addition to the requirements described for the Level 2, the Level 3 requires:
One or more information security industry certifications (e.g., CISSP, CISM, CISA, CEH, or equivalent) are required.
________________________________________
Experience: Level 1 - No experience required beyond the minimum education (or equivalency) requirement.
Level 2 - Two years of related experience is required.
Level 3 - Four years of related experience is required.
________________________________________
Skills: All Levels:
Must have conceptual familiarity with most of the the following information security practices, standards, and systems:
- Data Loss Prevention (DLP)
- Intrusion Detection and Prevention Systems (IDS/IPS)
- Security Information Event Management (SIEM) systems
- Virtual Private Network (VPN) systems
- Encryption technologies and standards
- Endpoint security
- Firewalls
- Cloud security platforms and tools
- Incident response
- Forensic investigation
- Network and/or application penetration testing
- Vulnerability management
- Vulnerability scanning tools
- Governance, Risk, Policy, and Exception Management
- Business Continuity and Disaster Recovery (BCDR)
- Identity and Access Management (IAM)
- Risk assessment practices
- Security Awareness and Training
Must have a working knowledge of at least one of the following regulatory compliance requirements and IT management frameworks:
- FISMA
- NIST information security standards
- HIPAA Security and/or Privacy Rules
- HITECH and Meaningful Use
- HITRUST Common Security Framework (CSF)
- ISO 27000-series standards
- PCI DSS
________________________________________
The intent of this job description is to provide a representative and level of the types of duties and responsibilities that will be required of positions given this title and shall not be construed as a declaration of the total of the specific duties and responsibilities of any position. Employees may be directed to perform job-related tasks other than those specifically presented in this description.
________________________________________
Duke University is an Affirmative Action/Equal Opportunity Employer committed to providing employment opportunity without regard to an individual's age, color, disability, gender, gender expression, gender identity, genetic information, national origin, race, religion, sex, sexual orientation, or veteran status.
Duke aspires to create a community built on collaboration, innovation, creativity, and belonging. Our collective success depends on the robust exchange of ideas-an exchange that is best when the rich diversity of our perspectives, backgrounds, and experiences flourishes. To achieve this exchange, it is essential that all members of the community feel secure and welcome, that the contributions of all individuals are respected, and that all voices are heard. All members of our community have a responsibility to uphold these values.
________________________________________
Essential Physical Job Functions
Certain jobs at Duke University and Duke University Health System may include essential job functions that require specific physical and/or mental abilities. Additional information and provision for requests for reasonable accommodation will be provided by each hiring department.
Duke is an Affirmative Action/Equal Opportunity Employer committed to providing employment opportunity without regard to an individual's age, color, disability, gender, gender expression, gender identity, genetic information, national origin, race, religion, sex, sexual orientation, or veteran status.
Duke aspires to create a community built on collaboration, innovation, creativity, and belonging. Our collective success depends on the robust exchange of ideas-an exchange that is best when the rich diversity of our perspectives, backgrounds, and experiences flourishes. To achieve this exchange, it is essential that all members of the community feel secure and welcome, that the contributions of all individuals are respected, and that all voices are heard. All members of our community have a responsibility to uphold these values.
Essential Physical Job Functions: Certain jobs at Duke University and Duke University Health System may include essentialjob functions that require specific physical and/or mental abilities. Additional information and provision for requests for reasonable accommodation will be provided by each hiring department.