Staff Security Analyst
New York, NY or Remote /
Who We Are
Ro is a direct-to-patient healthcare company providing high-quality, affordable healthcare without the need for insurance. Ro is the only company to seamlessly connect telehealth, in-home care, diagnostics, labs, and pharmacy services nationwide. This is enabled by Ro's vertically integrated platform that powers a personalized, end-to-end healthcare experience from diagnosis, to delivery of medication, to ongoing care. Since 2017, Ro has facilitated more than eight million digital healthcare visits in nearly every county in the United States, including 98% of primary care deserts. Visit Ro.co for more information.
Ro was named #2 in Wellness on Fast Company's 2019 list of the World's Most Innovative Companies, recognized as a CNBC Disruptor 50 in 2022, listed by Inc. Magazine as a Best Place to Work in 2022 for our third consecutive year, and named one of FORTUNE's 2022 Best Medium Workplaces.
We are seeking a Staff Security Analyst with broad vision and a deep understanding of the cybersecurity tradecraft, responsible for executing our most comprehensive investigations and developing innovative solutions to track and defend against sophisticated adversaries.
Successful candidates will have in-depth technical knowledge of adversary tactics, techniques, and procedures; the ability to analyze, correlate, and interpret complex events and anomalies; and the ability to innovate detection techniques leveraging engineering teams and processes. The candidate will be able to assume incident command during IR, navigate between task and goal level discussions gracefully, and collaborate with other experts with a clear mental map representing the SOC as our technical subject matter expert.
Preferred candidates will be assertive but open-minded critical thinkers with a high ownership mentality, understanding they own the goals and the outcomes. They are comfortable displaying humility in an environment where it’s not about “being right”, rather we are all responsible for coming up with the best answer to achieve our mission.
What You'll Do
- Serve in the team’s highest escalation unit for technical cybersecurity analysis and response, leveraging superior investigative skills and knowledge of adversary tactics, techniques, and procedures.
- Command cyber incident response efforts, quickly correlate multiple data sources, and apply various analytical techniques to determine the best remediation strategy tracking incidents to completion.
- Impact program strategy across multiple competency domains including external threat, insider risk, fraud management, and physical security.
- Provide subject matter expertise during meetings while speaking about complex topics to both technical and non-technical colleagues, partners, and business leaders.
- Leverage best-of-breed technologies to perform investigations in coordination with both our managed security providers and internal SOC personnel.
- Develop new hypotheses and advanced searches within a rich dataset to discover adversary tactics, techniques and procedures in near-real-time and retrospectively as identified by threat intelligence.
- Create, maintain, and execute incident response playbooks to drive manual and automated analysis for the entire SOC within a SIEM and SOAR platform.
- Provide oversight, mentorship, training, and development to junior analysts.
- Work with multiple stakeholder teams such as IT, Threat Intelligence, Product Security, Infrastructure and patient care teams to solve security challenges at scale while balancing usability, stability, scalability and performance.
What You'll Bring
- Bachelor’s degree in a technical field, or equivalent work experience.
- 7 years of experience in a security operations and incident response role.
- GCIH certified; experienced in incident management, crisis management, and/or breach response with in-depth knowledge of monitoring and response procedures.
- Broad understanding of the risks facing the security industry, including current and emerging threats.
- Excellent analytical process, hypothesis generation, and reporting skills.
- Advanced proficiency in network/host based intrusion analysis, malware analysis, cloud native response, and/or forensics (disk/memory).
- Advanced understanding of tactics, techniques and procedures following industry recognized frameworks such as MITRE ATT&CK.
- Solid understanding of network protocols and architecture.
- Basic scripting/programming (Python, PowerShell, Bash, etc.) skills.
- Experience designing remediation and recovery plans.
- Strong oral and written organizational and interpersonal skills.
- Nice to have, certified GCIA, GCFA, GNFA, GCFR, GREM, GIME or equivalents.
Benefits + Perks:
- Full medical, dental, and vision insurance + OneMedical membership
- Healthcare and Dependent Care FSA
- 401(k) with company match
- Flexible PTO
- Wellbeing + Learning & Growth reimbursements
- Paid parental leave + Fertility benefits
- Pet insurance
- Student loan refinancing
- Virtual resources for mindfulness, counseling, fitness, and physical therapy
The target base salary for this position ranges from $153,000 - 195,500 in addition to a competitive equity and benefits package (as applicable). When determining compensation, we analyze and carefully consider several factors, including location, job-related knowledge, skills and experience. These considerations may cause your compensation to vary.
Ro recognizes the power of in-person collaboration, while supporting the flexibility to work anywhere in the United States. For our Ro’ers in the tri-state (NY) area, you will join us at HQ on Tuesdays and Thursdays. For those outside of the tri-state area, you will be able to join in-person collaborations throughout the year (i.e., during team on-sites).
At Ro, we believe that our diverse perspectives are our biggest strengths — and that embracing them will create real change in healthcare. As an equal opportunity employer, we are committed to building an inclusive environment where you can be you.