Cql

Cql Cybersecurity Jobs

2 jobs found

Today

Information Security Analyst

UChicago Medicine Round Lake, IL 🇺🇸 Remote

Round Lake, IL

Today

Full time Cql Cybersecurity Tools Data Analysis

Apply Now

Job Description

The Information Security Analyst role is a remote position within UChicago Medicine's Information Security department in Illinois. The analyst will monitor and respond to security events, participate in incident response on on-call rotations, and contribute to the ongoing enhancement of SOC workflows and documentation.

Responsibilities

Assist with incident response, triage, and investigations for security events such as malware incidents, phishing campaigns, threats, and related activity.
Utilize threat intelligence and internal knowledge to proactively hunt for active threats and indicators of malicious activity.
Prepare incident reports, threat assessments, and security operation documentation for stakeholders.
Contribute to the continuous improvement of security operations playbooks, documentation, trends, and lessons learned from incidents in collaboration with the Security Operations team.
Coordinate eDiscovery requests and Insider Threat investigations in partnership with Privacy, Legal, and HR teams.
Support Threat Hunting and Intelligence efforts, participate in detection development, automation initiatives, and SOC AI workflows.
Investigate and respond to email-based threats such as phishing, business email compromise, malware delivery, and account takeover.
Monitor the Security Operations service and the incident queue to ensure timely handling.
Join the on-call rotation and respond to critical security events as required.

Requirements

BS or BA degree in Computer Science, Engineering, or an equivalent education with relevant training or work experience.
Four years of security experience, or an equivalent combination of training and education.
Strong knowledge of computing systems, data network communications, and network architecture.
Experience with security information and event management (SIEM) platforms and query languages, including Yara-L, CQL, and SPL.
Solid understanding of network security fundamentals, Network Detection and Response (NDR), intrusion detection, incident detection/response, malware analysis, cyber forensics, SIEM concepts, and security best practices; additional duties as assigned.
Scripting or programming skills preferred, with experience in Python, PowerShell, or Go.
Demonstrated service orientation with strong verbal, written, and reporting abilities.
High integrity and sound judgment regarding security and privacy.

Technologies

Key tools and languages: Yara-L, CQL, SPL, Python, PowerShell, Go, SIEM

Position Details

Job Type / FTE: Full Time, 1.0 FTE
Shift: Day
Location: Remote
Unit / Department: Information Security
CBA Code: Non-Union

View full job page →

Today

Information Security Engineer – Security Automation and Response

UChicago Medicine Round Lake, IL 🇺🇸 Remote

Round Lake, IL

Today

Full time Cql Cybersecurity Tools Engineer

Apply Now

Job Description

Remote Information Security Engineer – Security Automation and Response at UChicago Medicine, based in Illinois with remote work options.

Responsibilities

Design, implement, and maintain SOAR playbooks to automate routine security tasks such as alert triage, threat investigation, and incident response, leveraging SOAR platforms, Python, and API integrations.
Apply expertise in threat detection development, automate SOAR development processes, and contribute to incident response workflows.
Collaborate with the Information Security Operations Manager to advance Security Operations capabilities through AI-driven initiatives.
Investigate malware activity, intrusions, unauthorized access, and data infiltration and exfiltration events.
Examine logs, memory captures, disk images, and network captures to define attack scope and impact.
Stay informed on evolving cyber threats and standard SOC practices to continuously enhance Security Operations Center capabilities.
Demonstrate strong knowledge of security information and event management (SIEM) platforms and query languages such as Yara-L, CQL, SPL, and related tooling.
Participate in Purple Team activities to strengthen defensive and offensive testing cycles.
Join the on-call rotation and respond to critical security events as needed.

Requirements

BS or BA degree in Computer Science, Engineering, or equivalent education, training, or work experience.
Five years of security experience or equivalent combination of training and education.
Knowledge of computing systems, data network communications, and network architecture.
Effective written and verbal communication skills.
Experience in SOAR playbook development.
Scripting or programming skills required (Python, PowerShell, Go, etc.).
Experience in Incident Response and Threat investigation.
Experience in Threat detection.
Understanding of logging systems.
Security related certifications are preferred (GIAC, CISSP).

Technologies

SOAR
Python
API integrations
Yara-L
CQL
SPL
PowerShell
Go
SIEM

Essential Job Functions

Develop, implement, and maintain SOAR playbooks to automate repetitive security tasks, such as alert triage, threat investigation, and incident response, using tools like SOAR, Python, and API integrations.
Leverage knowledge of threat detection development, automation of SOAR development, and Incident Response to drive security outcomes.
Support initiatives with the Information Security Operations Manager to enhance Security Operations capabilities using AI.
Investigate malware, intrusions, unauthorized access, and data infiltration and exfiltration events.
Analyze logs, memory, disk images, and network captures to determine attack scope and impact.
Stay informed on cyber threats and standard SOC processes to continuously improve Security Operations Center capabilities.
Maintain strong proficiency with SIEM platforms and query languages (Yara-L, CQL, SPL, etc.).
Participate in Purple Team activities.
Participate in on-call rotation and respond to critical security events.

Required Qualifications

BS or BA degree, Computer Science, Engineering, or equivalent education, training, or work experience.
Five years of security experience, or equivalent training and education.
Knowledge of computing systems, data network communications, and network architecture.
Effective written and verbal communication skills.
Experience in SOAR playbook development.
Scripting or programming skills (Python, PowerShell, Go, etc.) required.
Experience in Incident Response and Threat investigation.
Experience in Threat detection.
Understanding of logging systems.
Security related certifications are preferred (GIAC, CISSP).

Position Details

Job Type/FTE: Full Time (1.0 FTE)
Shift: Day
Location: Remote
Unit/Department: Information Security
CBA Code: Non-Union

View full job page →

Cql Cybersecurity Jobs

Information Security Analyst

Information Security Engineer – Security Automation and Response

Get Cql Cybersecurity Jobs alerts