The Cyber Defense Optimization Engineer II
HCA Healthcare · Nashville, TN · 1 mo ago
On-siteHealthcareFull-time
We need to output HTML fragment with sections: headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes: job summary and qualifications, major responsibilities, desired experience, qualifications you will need, special qualifications, benefits. No explicit Pay or Schedule. So we can have sections: About the role (maybe from job summary), Responsibilities, Requirements (maybe combine desired experience and qualifications), Qualifications (maybe special qualifications?), Skills (maybe list of tools?), Benefits. Need to decide.
We must not repeat job title as heading. Use
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes: job summary and qualifications, major responsibilities, desired experience, qualifications you will need, special qualifications, benefits. No explicit Pay or Schedule. So we can have sections: About the role (maybe from job summary), Responsibilities, Requirements (maybe combine desired experience and qualifications), Qualifications (maybe special qualifications?), Skills (maybe list of tools?), Benefits. Need to decide.
We must not repeat job title as heading. Use for each section heading. Use - for any list of duties/requirements/benefits. Use
for prose.
We must preserve all substantive information, not invent or summarize away detail. Remove boilerplate: EEO, equal-opportunity, scam-warning, navigation, cookie, legal, duplicated lines, application instructions. Also remove "Learn More About Employee Benefits" maybe? It's part of benefits but maybe keep? It's a link? We'll keep benefits description.
We need to include all substantive info: job summary paragraph, major responsibilities bullet list, desired experience bullet list, qualifications you will need bullet list, special qualifications bullet list, benefits paragraph list.
We must not create Pay/Schedule sections because not present.
We need to decide headings: "About the role" could contain job summary paragraph. "Responsibilities" for major responsibilities. "Requirements" could combine desired experience and qualifications you will need? But we have separate sections maybe "Qualifications" for qualifications you will need and special qualifications? However we need to avoid thin sections. Could combine qualifications and special qualifications into one "Qualifications" section with sublists? But we must use only
headings, not nested. Could have separate sections: "Qualifications" and "Special Qualifications". Both have content.
Also "Skills" maybe list of tools? The desired experience includes list of security tools. Could be a "Skills" section.
We need to avoid filler like "commensurate with experience". Not present.
Let's extract content.
Job Summary And Qualifications paragraph: "The Cyber Defense Optimization Engineer II plays a critical role in enhancing the operational maturity of Cyber Defense & Response (CDR) by supporting onboarding, upskilling, and continuous improvement initiatives. This role focuses on enabling technical teams through structured learning paths, process refinement, and metrics-driven performance tracking. The ideal candidate will be passionate about cybersecurity enablement, process optimization, and fostering a culture of continuous learning and innovation."
That's about the role.
Major Responsibilities list:
- Support onboarding of new CDR use cases through structured enablement programs and documentation.
- Develop and maintain upskilling resources, including technical training materials, workshops, and hands-on labs.
- Collaborate with cross-functional teams to identify and implement process improvements that enhance operational efficiency.
- Assist in the development and tracking of performance metrics to measure maturity, effectiveness, and impact of cyber defense initiatives.
- Contribute to the coordination and prioritization of Security Telemetry Onboarding Requests (STOR) across CDR.
- Participate in technical enablement efforts, including tool adoption, workflow optimization, and knowledge sharing.
- Help drive innovation by identifying opportunities for automation and AI integration in onboarding and training processes.
- Maintain alignment with broader CDR goals and ensure continuous feedback loops between teams.
- Routinely collaborate with individuals and teams from across the enterprise.
Desired Experience list (some duplicated lines). Let's consolidate unique items:
- Experience (3+ years) as a member of a Cyber Incident Response Team (CIRT) or comparable team.
- Experience (1+ years) with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH).
- Experience (1+ years) consuming and generating cybersecurity threat intelligence.
- Experience (3+ years) across the technology stack.
- Familiarity with all OSI layers and expertise in some.
- Experience (3+ years) using the following types of security tools:
o SIEM
o Firewalls
o Web Proxy
o Anti-Virus (AV)
o Next Gen Anti-Virus (NGAV)
o Endpoint Detection and Response (EDR)
o Sandboxing
o Virtual Machines
o Netflow analysis
o Malware Repositories
o Threat Intelligence
o Deception Stack
o Intrusion Detection/Prevention System (IDS/IPS)
o Security Orchestration Automation Response (SOAR)
o Phishing Triage
o User Behavior Analytics (UBA)
o Email Hygiene and Filtering
- Experience (3+ years) interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Legal, Risk/Governance, etc.)
- Experience (3+ years) working in a high-tempo, dynamic environment with a high-performance team.
- Experience (3+ years) with work ticketing systems (e.g. – ServiceNow, JIRA).
Qualifications you will need:
- Bachelor's Degree required
- Three or more years of relevant work experience
Special Qualifications:
- Experience as Security Operations Center lead/senior analyst role for 1+ years.
- Able to maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and vendor offerings via self-directed learning and formal training.
- Excellent critical thinking skills to understand available data and use it to support or refute potential hypothesis that explain the data.
- Use available data to develop and communicate conclusions and recommendations.
- An ability to work and thrive in stressful situations.
- A demeanor that conveys calm professionalism in stressful situations.
- An ability to maintain confidentiality of sensitive data and to follow proper ethical practices for using tools and accessing data.
- A strong desire to determine root cause of events.
- A willingness to fully investigate all alternatives exhaustively until a conclusion can be supported.
- Ability to self-prioritize tasks based on criticality and threat level.
- Advanced written and oral communication skills.
- The following certifications and courses are helpful, but not required: Certified Ethical Hacker (CEH) GIAC: GSEC, GCIH, GCIA, GCED, GMON, GCDA, GDAT, GCFE or comparable CompTIA Security+
Benefits paragraph: "HCA Healthcare, offers a total rewards package that supports the health, life, career and retirement of our colleagues. The available plans and programs include: Comprehensive benefits for medical, prescription drug, dental, vision, behavioral health and telemedicine services Wellbeing support, including free counseling and referral services Time away from work programs for paid time off, paid family leave, long- and short-term disability coverage and leaves of absence Savings and retirement resources, including a 401(k) Plan with a 100% match on 3% to 9% of pay (based on years of service), Employee Stock Purchase Plan, flexible spending accounts, preferred banking partnerships, retirement readiness tools, rollover support and financial wellbeing counseling Education support through tuition assistance, student loan assistance, certification support, dependent scholarships and a partnership with Galen College of Nursing Additional benefits for fertility and family building, adoption assistance, life insurance, supplemental health protection plans, auto and home insurance, legal counseling, identity theft protection and consumer discounts Learn More About Employee Benefits Note: Eligibility for benefits may vary by location."
We should strip "Learn More About Employee Benefits" maybe as it's a link; but it's still substantive? It's a call to action; could be considered application instruction? It's not exactly application instruction but it's a link. Safer to remove it as it's like navigation. Also remove the note about eligibility maybe keep? It's substantive but could be considered minor metadata. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." The note about eligibility is minor metadata; we could fold into a short p or drop. Probably drop to keep concise.
Also remove the quoted mission statement and founder quote? It's not boilerplate? It's maybe considered filler? It's not essential job info. Could be considered boilerplate? It's a quote; not required. Safer to drop.
Also remove "HCA Healthcare has been recognized as one of the World's Most Ethical Companies®..." etc. That's boilerplate.
Thus keep only job summary, responsibilities, desired experience, qualifications, special qualifications, benefits.
Now produce HTML.
We'll have sections:
About the role
...job summary...
Responsibilities
- ... each responsibility...
Desired Experience
- ... each bullet...
Qualifications
- Bachelor's Degree required
- Three or more years of relevant work experience
Special Qualifications
- ... each bullet...
Skills
maybe list of tools? But we already have tools under desired experience. Could create a Skills section listing the tools. However we already listed them under desired experience; we could keep them there. The instruction: "Prefer a few substantive sections over many thin ones." Having both Desired Experience and Skills may be thin. Better to keep Desired Experience includes tools; we can keep that as is.
We could also combine Qualifications and Special Qualifications into one "Qualifications" section but they are distinct. However we could have "Qualifications" containing both basic and special qualifications. That would reduce sections. Let's do that: one Qualifications section with sublists? But we cannot nest headings inside; we can just have a single with all qualification items (including special). That would be okay.
Thus sections: About the role, Responsibilities, Desired Experience, Qualifications, Benefits.
Check if we need Skills separate? Not needed.
Now ensure we preserve all substantive info: we must include all items from desired experience, qualifications, special qualifications.
Let's list them.
Desired Experience items (unique):
1. Experience (3+ years) as a member of a Cyber Incident Response Team (CIRT) or comparable team.
2. Experience (1+ years) with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH).
3. Experience (1+ years) consuming and generating cybersecurity threat intelligence.
4. Experience (3+ years) across the technology stack.
5. Familiarity with all OSI layers and expertise in some.
6. Experience (3+ years) using the following types of security tools:
- SIEM
- Firewalls
- Web Proxy
- Anti-Virus (AV)
- Next Gen Anti-Virus (NGAV)
- Endpoint Detection and Response (EDR)
- Sandboxing
- Virtual Machines
- Netflow analysis
- Malware Repositories
- Threat Intelligence
- Deception Stack
- Intrusion Detection/Prevention System (IDS/IPS)
- Security Orchestration Automation Response (SOAR)
- Phishing Triage
- User Behavior Analytics (UBA)
- Email Hygiene and Filtering
7. Experience (3+ years) interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Legal, Risk/Governance, etc.)
8. Experience (3+ years) working in a high-tempo, dynamic environment with a high-performance team.
9. Experience (3+ years) with work ticketing systems (e.g. – ServiceNow, JIRA).
Qualifications you will need:
- Bachelor's Degree required
- Three or more years of relevant work experience
Special Qualifications items:
- Experience as Security Operations Center lead/senior analyst role for 1+ years.
- Able to maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and vendor offerings via self-directed learning and formal training.
- Excellent critical thinking skills to understand available data and use it to support or refute potential hypothesis that explain
- for any list of duties/requirements/benefits. Use
for prose. We must preserve all substantive information, not invent or summarize away detail. Remove boilerplate: EEO, equal-opportunity, scam-warning, navigation, cookie, legal, duplicated lines, application instructions. Also remove "Learn More About Employee Benefits" maybe? It's part of benefits but maybe keep? It's a link? We'll keep benefits description. We need to include all substantive info: job summary paragraph, major responsibilities bullet list, desired experience bullet list, qualifications you will need bullet list, special qualifications bullet list, benefits paragraph list. We must not create Pay/Schedule sections because not present. We need to decide headings: "About the role" could contain job summary paragraph. "Responsibilities" for major responsibilities. "Requirements" could combine desired experience and qualifications you will need? But we have separate sections maybe "Qualifications" for qualifications you will need and special qualifications? However we need to avoid thin sections. Could combine qualifications and special qualifications into one "Qualifications" section with sublists? But we must use only
headings, not nested. Could have separate sections: "Qualifications" and "Special Qualifications". Both have content. Also "Skills" maybe list of tools? The desired experience includes list of security tools. Could be a "Skills" section. We need to avoid filler like "commensurate with experience". Not present. Let's extract content. Job Summary And Qualifications paragraph: "The Cyber Defense Optimization Engineer II plays a critical role in enhancing the operational maturity of Cyber Defense & Response (CDR) by supporting onboarding, upskilling, and continuous improvement initiatives. This role focuses on enabling technical teams through structured learning paths, process refinement, and metrics-driven performance tracking. The ideal candidate will be passionate about cybersecurity enablement, process optimization, and fostering a culture of continuous learning and innovation." That's about the role. Major Responsibilities list: - Support onboarding of new CDR use cases through structured enablement programs and documentation. - Develop and maintain upskilling resources, including technical training materials, workshops, and hands-on labs. - Collaborate with cross-functional teams to identify and implement process improvements that enhance operational efficiency. - Assist in the development and tracking of performance metrics to measure maturity, effectiveness, and impact of cyber defense initiatives. - Contribute to the coordination and prioritization of Security Telemetry Onboarding Requests (STOR) across CDR. - Participate in technical enablement efforts, including tool adoption, workflow optimization, and knowledge sharing. - Help drive innovation by identifying opportunities for automation and AI integration in onboarding and training processes. - Maintain alignment with broader CDR goals and ensure continuous feedback loops between teams. - Routinely collaborate with individuals and teams from across the enterprise. Desired Experience list (some duplicated lines). Let's consolidate unique items: - Experience (3+ years) as a member of a Cyber Incident Response Team (CIRT) or comparable team. - Experience (1+ years) with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH). - Experience (1+ years) consuming and generating cybersecurity threat intelligence. - Experience (3+ years) across the technology stack. - Familiarity with all OSI layers and expertise in some. - Experience (3+ years) using the following types of security tools: o SIEM o Firewalls o Web Proxy o Anti-Virus (AV) o Next Gen Anti-Virus (NGAV) o Endpoint Detection and Response (EDR) o Sandboxing o Virtual Machines o Netflow analysis o Malware Repositories o Threat Intelligence o Deception Stack o Intrusion Detection/Prevention System (IDS/IPS) o Security Orchestration Automation Response (SOAR) o Phishing Triage o User Behavior Analytics (UBA) o Email Hygiene and Filtering - Experience (3+ years) interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Legal, Risk/Governance, etc.) - Experience (3+ years) working in a high-tempo, dynamic environment with a high-performance team. - Experience (3+ years) with work ticketing systems (e.g. – ServiceNow, JIRA). Qualifications you will need: - Bachelor's Degree required - Three or more years of relevant work experience Special Qualifications: - Experience as Security Operations Center lead/senior analyst role for 1+ years. - Able to maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and vendor offerings via self-directed learning and formal training. - Excellent critical thinking skills to understand available data and use it to support or refute potential hypothesis that explain the data. - Use available data to develop and communicate conclusions and recommendations. - An ability to work and thrive in stressful situations. - A demeanor that conveys calm professionalism in stressful situations. - An ability to maintain confidentiality of sensitive data and to follow proper ethical practices for using tools and accessing data. - A strong desire to determine root cause of events. - A willingness to fully investigate all alternatives exhaustively until a conclusion can be supported. - Ability to self-prioritize tasks based on criticality and threat level. - Advanced written and oral communication skills. - The following certifications and courses are helpful, but not required: Certified Ethical Hacker (CEH) GIAC: GSEC, GCIH, GCIA, GCED, GMON, GCDA, GDAT, GCFE or comparable CompTIA Security+ Benefits paragraph: "HCA Healthcare, offers a total rewards package that supports the health, life, career and retirement of our colleagues. The available plans and programs include: Comprehensive benefits for medical, prescription drug, dental, vision, behavioral health and telemedicine services Wellbeing support, including free counseling and referral services Time away from work programs for paid time off, paid family leave, long- and short-term disability coverage and leaves of absence Savings and retirement resources, including a 401(k) Plan with a 100% match on 3% to 9% of pay (based on years of service), Employee Stock Purchase Plan, flexible spending accounts, preferred banking partnerships, retirement readiness tools, rollover support and financial wellbeing counseling Education support through tuition assistance, student loan assistance, certification support, dependent scholarships and a partnership with Galen College of Nursing Additional benefits for fertility and family building, adoption assistance, life insurance, supplemental health protection plans, auto and home insurance, legal counseling, identity theft protection and consumer discounts Learn More About Employee Benefits Note: Eligibility for benefits may vary by location." We should strip "Learn More About Employee Benefits" maybe as it's a link; but it's still substantive? It's a call to action; could be considered application instruction? It's not exactly application instruction but it's a link. Safer to remove it as it's like navigation. Also remove the note about eligibility maybe keep? It's substantive but could be considered minor metadata. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." The note about eligibility is minor metadata; we could fold into a short p or drop. Probably drop to keep concise. Also remove the quoted mission statement and founder quote? It's not boilerplate? It's maybe considered filler? It's not essential job info. Could be considered boilerplate? It's a quote; not required. Safer to drop. Also remove "HCA Healthcare has been recognized as one of the World's Most Ethical Companies®..." etc. That's boilerplate. Thus keep only job summary, responsibilities, desired experience, qualifications, special qualifications, benefits. Now produce HTML. We'll have sections:
About the role
...job summary...
Responsibilities
- ... each responsibility...
Desired Experience
- ... each bullet...
Qualifications
- Bachelor's Degree required
- Three or more years of relevant work experience
Special Qualifications
- ... each bullet...
Skills
maybe list of tools? But we already have tools under desired experience. Could create a Skills section listing the tools. However we already listed them under desired experience; we could keep them there. The instruction: "Prefer a few substantive sections over many thin ones." Having both Desired Experience and Skills may be thin. Better to keep Desired Experience includes tools; we can keep that as is. We could also combine Qualifications and Special Qualifications into one "Qualifications" section but they are distinct. However we could have "Qualifications" containing both basic and special qualifications. That would reduce sections. Let's do that: one Qualifications section with sublists? But we cannot nest headings inside; we can just have a single- with all qualification items (including special). That would be okay.
Thus sections: About the role, Responsibilities, Desired Experience, Qualifications, Benefits.
Check if we need Skills separate? Not needed.
Now ensure we preserve all substantive info: we must include all items from desired experience, qualifications, special qualifications.
Let's list them.
Desired Experience items (unique):
1. Experience (3+ years) as a member of a Cyber Incident Response Team (CIRT) or comparable team.
2. Experience (1+ years) with an event/information analysis framework such as Analysis of Competing Hypotheses (ACH).
3. Experience (1+ years) consuming and generating cybersecurity threat intelligence.
4. Experience (3+ years) across the technology stack.
5. Familiarity with all OSI layers and expertise in some.
6. Experience (3+ years) using the following types of security tools:
- SIEM
- Firewalls
- Web Proxy
- Anti-Virus (AV)
- Next Gen Anti-Virus (NGAV)
- Endpoint Detection and Response (EDR)
- Sandboxing
- Virtual Machines
- Netflow analysis
- Malware Repositories
- Threat Intelligence
- Deception Stack
- Intrusion Detection/Prevention System (IDS/IPS)
- Security Orchestration Automation Response (SOAR)
- Phishing Triage
- User Behavior Analytics (UBA)
- Email Hygiene and Filtering
7. Experience (3+ years) interfacing with peer support teams (Security Engineering, Vulnerability and Patching Teams, Networking, Access Management, Legal, Risk/Governance, etc.)
8. Experience (3+ years) working in a high-tempo, dynamic environment with a high-performance team.
9. Experience (3+ years) with work ticketing systems (e.g. – ServiceNow, JIRA).
Qualifications you will need:
- Bachelor's Degree required
- Three or more years of relevant work experience
Special Qualifications items:
- Experience as Security Operations Center lead/senior analyst role for 1+ years.
- Able to maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and vendor offerings via self-directed learning and formal training.
- Excellent critical thinking skills to understand available data and use it to support or refute potential hypothesis that explain