{"id":2544385,"url":"https://alion.io/job/corrohealth-information-security-analyst-2","title":"Information Security Analyst-2","company":{"id":5772,"name":"CorroHealth","domain":"corrohealth.com","url":"https://alion.io/company/corrohealth","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"C","score":69,"open_postings":33,"ghost_share":0.515,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":36,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Noida, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":13000,"max_usd":31000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Crowdstrike","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"SIEM","optional":false},{"name":"Azure","optional":true},{"name":"Incident Management","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-14T16:23:55Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-14T20:28:56Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":1},"description":"About Us:\nOur purpose is to help clients exceed their financial health goals. Across the reimbursement cycle, our scalable solutions and clinical expertise help solve programmatic needs. Enabling our teams with leading technology allows analytics to guide our solutions and keeps us accountable achieving goals.\nWe build long-term careers by investing in YOU. We seek to create an environment that cultivates your professional development and personal growth, as we believe your success is our success.\nESSENTIAL DUTIES AND RESPONSIBILITIES:\nNote: The essential duties and responsibilities below are intended to describe the general duties and responsibilities of this position and are not intended to be an exhaustive statement of duties. This position may perform all or most of the primary duties listed below. Specific tasks, responsibilities or competencies may be documented in the Team Member’s performance objectives as outlined by the Team Member’s immediate Leadership Team Member.\nSenior SOC Analyst :\n\nJob Summary\nWe are seeking an experienced Senior SOC Analyst to strengthen our Cyber Security Operations Center (SOC). The ideal candidate will have strong hands-on experience with CrowdStrike Falcon EDR, CrowdStrike Next-Gen SIEM, Microsoft Defender security solutions, Email Security platforms, and advanced threat hunting capabilities. The role requires expertise in security monitoring, incident investigation, detection engineering, and SIEM query development using CrowdStrike Query Language (CQL) and/or Kusto Query Language (KQL).\nThe candidate will proactively identify, investigate, and respond to cybersecurity threats while continuously improving detection and response capabilities across the enterprise.\nKey Responsibilities\nSecurity Monitoring & Incident Response\nMonitor security alerts from CrowdStrike Falcon, NG-SIEM, Microsoft Defender, email security platforms, and other security controls.\nPerform triage, analysis, containment, eradication, and recovery activities for security incidents.\nLead investigations involving malware, phishing, ransomware, insider threats, and suspicious user activities.\nConduct root cause analysis and document incident findings and recommendations.\nCoordinate with IT, Infrastructure, Cloud, Network, and Business teams during incident response activities.\nCrowdStrike EDR & NG-SIEM Administration\nManage and optimize CrowdStrike Falcon EDR policies and detection configurations.\nDevelop and fine-tune custom detection rules and alerting logic.\nConfigure and manage CrowdStrike NG-SIEM data ingestion, use cases, dashboards, and reporting.\nPerform endpoint threat analysis and remediation using Falcon Real-Time Response.\nSupport deployment and maintenance of Falcon Data Protection, Identity Protection, and Endpoint Security modules.\nThreat Hunting & Detection Engineering\nConduct proactive threat hunting activities using CrowdStrike Falcon, NG-SIEM, and Defender telemetry.\nIdentify indicators of compromise (IOCs), indicators of attack (IOAs), and anomalous behaviors.\nDevelop detection content using CQL and KQL queries.\nBuild and maintain threat hunting playbooks and investigation workflows.\nResearch emerging threats, attacker techniques, and industry threat intelligence.\nMicrosoft Defender Security Operations\nInvestigate alerts generated by Microsoft Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender XDR.\nPerform advanced hunting using KQL.\nOptimize Defender detection rules and reduce false positives.\nCorrelate Defender telemetry with CrowdStrike and SIEM events.\nEmail Security Operations\nManage and investigate alerts from Mimecast, Microsoft Defender for Office 365, Proofpoint, or similar email security platforms.\nAnalyze phishing, spoofing, malicious attachments, and business email compromise (BEC) incidents.\nDevelop email security monitoring and response procedures.\nCoordinate end-user awareness and phishing response activities.\nReporting & Governance\nDevelop SOC operational dashboards and security metrics.\nCreate executive and management reports on threats, incidents, and trends.\nSupport audit, compliance, and cyber risk assessment activities.\nMentor junior SOC analysts and support skill development across the SOC team.\nRequired Qualifications\nBachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.\n5-8+ years of experience in Security Operations Center (SOC) or Cyber Defense environments.\nMinimum 2+ years of hands-on experience with CrowdStrike Falcon EDR.\nExperience working with CrowdStrike NG-SIEM.\nExperience with Microsoft Defender XDR ecosystem.\nStrong understanding of cybersecurity frameworks, attack techniques, and threat intelligence.\nExperience in incident response and forensic investigations.\nTechnical Skills\nMandatory Skills\nCrowdStrike Falcon EDR\nCrowdStrike NG-SIEM\n CrowdStrike Query Language (CQL)\n Microsoft Defender XDR\nKusto Query Language (KQL)\nThreat Hunting\nIncident Response\nEndpoint Security\nIOC/IOA Analysis\n Email Security (Mimecast)\nSIEM Operations\nLog Analysis\nMalware Analysis\nSecurity Investigations\nPreferred Skills\nAzure Security Controls\nNetwork Security Monitoring\nMITRE ATT&CK Framework\nPowerShell scripting\nPython scripting\nSOAR platforms\nCertifications (Preferred)\nCrowdStrike Falcon Administrator\nCrowdStrike Falcon Analyst\nMicrosoft SC-200 Security Operations Analyst\nMicrosoft SC-100 Cybersecurity Architect\nGCIH (GIAC Certified Incident Handler)\nGCFA (GIAC Certified Forensic Analyst)\nCompTIA CySA+\nCISSP\nKey Competencies\nAdvanced Threat Hunting\nDetection Engineering\nSecurity Analytics\nIncident Management\nProblem Solving\nAnalytical Thinking\nCommunication & Reporting\nStakeholder Management\nTeam Mentoring\nContinuous Improvement Mindset\nSeeking a Senior SOC Analyst with strong hands-on experience in CrowdStrike Falcon EDR, CrowdStrike Next-Gen SIEM, Microsoft Defender XDR, Email Security platforms (Mimecast/Defender O365), advanced threat hunting, incident response, and detection engineering using CQL and KQL. Experience building use cases, threat detection content, and leading cyber incident investigations is highly desirable.\nPHYSICAL DEMANDS:\nNote: Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions as described. Regular eye-hand coordination and manual dexterity is required to operate office equipment. The ability to perform work at a computer terminal for 6-8 hours a day and function in an environment with constant interruptions is required. At times, Team Members are subject to sitting for prolonged periods. Infrequently, Team Member must be able to lift and move material weighing up to 20 lbs. Team Member may experience elevated levels of stress during periods of increased activity and with work entailing multiple deadlines.\nA job description is only intended as a guideline and is only part of the Team Member’s function. The company has reviewed this job description to ensure that the essential functions and basic duties have been included. It is not intended to be construed as an exhaustive list of all functions, responsibilities, skills and abilities. Additional functions and requirements may be assigned by supervisors as deemed appropriate.","description_format":"text","description_chars":7261,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Revenue Cycle & Medical Billing"],"lifecycle":[{"event":"open","at":"2026-10-14T16:23:55Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":0,"expected_fill_days":36,"reasons":["conf:9","stale_co","win:early"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/corrohealth-information-security-analyst-2","json_url":"https://alion.io/job/corrohealth-information-security-analyst-2.json","meta":{"generated_at":"2026-10-15T16:57:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"assistant_verified","counted_by":"address","units_charged":1,"used_today":74,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5772},"rest":"https://alion.io/mcp/rest/get_company?id=5772"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcorrohealth-information-security-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcorrohealth-information-security-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcorrohealth-information-security-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/corrohealth-information-security-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcorrohealth-information-security-analyst-2"}]}