Role Description This role is for a Cyber Incident Response Team (CIRT) Analyst who will help to enhance DLP dashboards and workflows and streamline alert feeds. This includes: - Gathering requirements - Reviewing/labeling training data - Coordinating UAT with stakeholders Job Responsibilities: - Collaboration with the stakeholders and project team to understand business requirements - Documenting updates to CIRT workflows and dashboards - Documenting test cases, conducting tests, and recording results - Raising issues to be resolved prior to implementation Qualifications - Bachelor’s degree Requirements - Incident Response Operations – Intermediate - Security Information and Event Management (SIEM) – Intermediate - Data Loss Prevention (DLP) – Intermediate - Strong understanding of data security principles, network protocols, and cloud security – Intermediate - Technical aptitude for interpreting and modifying DLP rule logic – Intermediate - Vigilant, detail-oriented and possesses good business judgement to differentiate real threats from false positives – Intermediate Desired Skills - Microsoft Purview – Intermediate - Microsoft Sentinel (Security monitoring, alert creation and threat hunting) – Intermediate - Knowledge of Microsoft Azure access and identity management – Beginner - Agile methodologies – Intermediate Benefits - Comprehensive benefits package - Competitive pay

Department Name: IT Service Operations Work Shift: Night Job Category: Information Technology Estimated Pay Range: $40.91 - $68.19 / hour, based on location, education, & experience.In accordance with State Pay Transparency Rules. Banner Health was named to Fortune’s Most Innovative Companies in America 2025 list for the third consecutive year and named to Newsweek's list of Most Trustworthy Companies in America for the second year in a row. We’re proud to be recognized for our commitment to the latest health care advancements and excellent patient care. The Banner Health Critical Response team steps in when our most critical IT services are disrupted—mobilizing quickly to restore stability, safeguard patient care, and support the teams who depend on technology every minute of the day. As a Major Incident Commander, you will be the operational engine behind our major incident response: monitoring for impact, keeping timelines and documentation crisp and accurate, ensuring process adherence, and helping teams stay aligned under pressure. When incidents are not active, you’ll support operational readiness—so when the next high-severity event hits, we respond faster and smarter. You’ll work under the guidance of the Major Incident Commanders. This role requires variable shifts plus responding to 24x7 critical alerts via mobile device or other connected platform. The schedule for this role is Monday-Friday, 10:00PM - 6:30AM AZ Time. This can be a remote position if you live in the following states ONLY: Al, AK, AR, FL, GA, ID, IN, IA, KS, KY, LA, MD,MI, MN, MS, MO, NH, NM, NY, NC, ND, OH, OK, OR, PA, SC, TN, TX, UT, VA, WA, WI AZ CA CO NE NV WY. No other states will be consider. Your pay and benefits (Total Rewards) are important components of your Journey at Banner Health. Banner Health offers a variety of benefit plans to help you and your family. We provide health and financial security options, so you can focus on being the best at what you do and enjoying your life. Within Banner Health Corporate, you will have the opportunity to apply your unique experience and expertise in support of a nationally-recognized healthcare leader. We offer stimulating and rewarding careers in a wide array of disciplines. Whether your background is in Human Resources, Finance, Information Technology, Legal, Managed Care Programs or Public Relations, you'll find many options for contributing to our award-winning patient care. POSITION SUMMARY This position is an expert providing advanced leadership during the highest‑impact incidents and drives continuous improvement of the Major Incident Management practice. This role shapes strategy, mentors the team, and partners closely with leadership across the organization. Working variable shifts and responding to 24x7 critical alerts on a mobile device or other connected platform for service disruptions is required for this role. CORE FUNCTIONS 1. Leads coordination of complex or high-impact major incident bridge calls and communication channels. Provides guidance to Coordinators and supports Major Incident Commanders during critical events. 2. Reviews incident records, timelines, and activity logs for quality, accuracy, and audit readiness. Identifies opportunities for improvement. 3. Oversees and refines outage notifications and status updates. Ensures messaging is clear, audience-appropriate, and aligned with business and clinical impact. 4. Evaluates monitoring and alerting performance across systems. Drives improvements to alerting strategy, routing, and response workflows. 5. Collaborates closely with Problem Management to improve RCA quality, identify systemic issues, and recommend preventive or corrective actions to reduce repeat incidents. 6. Analyzes and interprets major incident SLAs and KPIs. Recommends process, tooling, or operational changes to improve performance and reliability. 7. Leads updates to playbooks, escalation paths, and communication templates based on post-incident reviews, exercises, and operational experience. 8. Maintains deep knowledge of enterprise platforms, incident response processes, stakeholders, and downtime procedures. Serves as a subject matter expert and mentor. 9. Exercises incident command authority during active major incidents, including determining severity, directing escalation paths, managing risk tradeoffs, and determining when incidents are stabilized or resolved. MINIMUM QUALIFICATIONS Experience and education as normally obtained through an Associate’s degree and 2+ years of relevant experience in IT operations, service desk, NOC, or incident management. Proven experience in leading high-severity, enterprise-impacting incidents. Experience developing or improving incident management processes, playbooks, or workflows. Advanced facilitation and communication skills, including executive-level communications. Strong analytical skills with the ability to identify systemic issues and operational risk. Ability to coach and mentor other coordinators. Ability and willingness to work variable shifts and respond to 24x7 critical alerts via mobile device or other connected platforms for service disruptions. PREFERRED QUALIFICATIONS Bachelor’s degree in Information Systems, Computer Science, Healthcare Informatics, Healthcare Administration, Business Administration, or a related field preferred. ITIL Intermediate/Managing Professional certification or equivalent experience. Experience partnering with senior IT leaders, vendors, or business stakeholders during critical incidents. Experience designing or leading tabletop exercises or simulations. Experience influencing tooling, alerting, or workflow optimization. Additional related education and/or experience preferred. EEO Statement: EEO/Disabled/Veterans Our organization supports a drug-free work environment. Privacy Policy: Privacy Policy

Department Name: IT Service Operations Work Shift: Day Job Category: Information Technology Estimated Pay Range: $46.84 - $78.06 / hour, based on location, education, & experience.In accordance with State Pay Transparency Rules. Banner Health was named to Fortune’s Most Innovative Companies in America 2025 list for the third consecutive year and named to Newsweek's list of Most Trustworthy Companies in America for the second year in a row. We’re proud to be recognized for our commitment to the latest health care advancements and excellent patient care. The Banner Health Critical Response team leads the charge when our most critical IT services are disrupted—moving fast to restore stability, protect patient care, and support the teams who rely on technology every minute of the day. As a Major Incident Commander, you are the calm, decisive commander at the center of high-impact incidents—aligning technical teams and business partners, driving rapid restoration, and delivering clear, timely communication throughout. You will also help shape our Major Incident Management strategy, strengthen and mentor the broader incident practice, and partner with leadership to turn every event into measurable, ongoing improvement. This role requires working variable shifts and responding to 24x7 critical alerts via mobile device or other connected platform. The schedule for this role is Monday-Friday, 6AM - 2:30pm AZ Time. This can be a remote position if you live in the following states ONLY: Al, AK, AR, FL, GA, ID, IN, IA, KS, KY, LA, MD,MI, MN, MS, MO, NH, NM, NY, NC, ND, OH, OK, OR, PA, SC, TN, TX, UT, VA, WA, WI AZ CA CO NE NV WY. No other states will be consider. Your pay and benefits (Total Rewards) are important components of your Journey at Banner Health. Banner Health offers a variety of benefit plans to help you and your family. We provide health and financial security options, so you can focus on being the best at what you do and enjoying your life. Within Banner Health Corporate, you will have the opportunity to apply your unique experience and expertise in support of a nationally-recognized healthcare leader. We offer stimulating and rewarding careers in a wide array of disciplines. Whether your background is in Human Resources, Finance, Information Technology, Legal, Managed Care Programs or Public Relations, you'll find many options for contributing to our award-winning patient care. POSITION SUMMARY This is a seasoned expert who provides senior-level leadership during the most complex and high-impact major incidents. This role operates with a high degree of autonomy, advising Incident Commanders, Major Incident Managers, and senior stakeholders to ensure effective coordination, decision support, and communication. Outside of active incidents, the role drives maturity of the Major Incident Management practice through advanced analysis, mentoring, and continuous improvement initiatives focused on reducing risk, improving response effectiveness, and increasing organizational resilience. Working variable shifts and responding to 24x7 critical alerts on a mobile device or other connected platform for service disruptions is required for this role. CORE FUNCTIONS 1. Serves as senior operational leader for major incident coordination. Mentors Coordinators and partners with Major Incident Commanders during the most critical and complex incidents. 2. Establishes standards for incident documentation, timelines, and communication quality. Leads quality assurance efforts across the incident lifecycle. 3. Defines and leads enterprise standards for outage notifications and status communications. Ensures consistency, transparency, and executive- and clinical-level alignment. 4. Leads enterprise-level monitoring and alerting strategy reviews. Champions proactive detection, automation, and response optimization. 5. Provides leadership in Problem Management integration by driving systemic RCA outcomes, validating corrective actions, and reducing organizational risk. 6. Leads the team in improving major incident response SLAs and KPIs through data-driven insights, process optimization, and cross-functional collaboration. 7. Owns the evolution of major incident playbooks, templates, escalation frameworks, and communication standards to ensure consistency and clinical alignment. 8. Maintains expert-level knowledge of enterprise technology platforms, security policies, major incident processes, stakeholders, and downtime procedures. Acts as a trusted advisor to leadership. 9. Provides final decision authority during the most complex or high-risk major incidents, including executive escalation, risk acceptance, service restoration prioritization, and coordination of enterprise response when patient care, safety, or organizational reputation may be impacted. MINIMUM QUALIFICATIONS Experience and education as normally obtained through an Associate’s degree and 5+ years of relevant experience in IT operations, service desk, NOC, or incident management. Recognized subject-matter expert in major incident response and operational resilience. Extensive experience leading the most complex, high-risk, enterprise-wide incidents. Proven ability to influence senior leadership and guide decision-making during crises. Demonstrated success driving maturity, governance, and continuous improvement initiatives. Advanced analytical and strategic thinking skills. Ability and willingness to work variable shifts and respond to 24x7 critical alerts via mobile device or other connected platforms for service disruptions. PREFERRED QUALIFICATIONS Bachelor’s degree in Information Systems, Computer Science, Healthcare Informatics, Healthcare Administration, Business Administration, or a related field strongly preferred. Advanced ITIL certifications or equivalent industry credentials. Experience shaping enterprise incident management strategy or operating model. Experience working in healthcare or other highly regulated, high-availability environments. Experience leading organization-wide preparedness, resilience, or risk-reduction initiatives. Additional related education and/or experience preferred. EEO Statement: EEO/Disabled/Veterans Our organization supports a drug-free work environment. Privacy Policy: Privacy Policy

Department Name: IT Service Operations Work Shift: Night Job Category: Information Technology Estimated Pay Range: $33.69 - $56.15 / hour, based on location, education, & experience.In accordance with State Pay Transparency Rules. Banner Health was named to Fortune’s Most Innovative Companies in America 2025 list for the third consecutive year and named to Newsweek's list of Most Trustworthy Companies in America for the second year in a row. We’re proud to be recognized for our commitment to the latest health care advancements and excellent patient care. The Banner Health Critical Response team steps in when our most critical IT services are disrupted—mobilizing quickly to restore stability, safeguard patient care, and support the teams who depend on technology every minute of the day. As a Major Incident Coordinator, you will be the operational engine behind our major incident response: monitoring for impact, keeping timelines and documentation crisp and accurate, ensuring process adherence, and helping teams stay aligned under pressure. When incidents are not active, you’ll support operational readiness—so when the next high-severity event hits, we respond faster and smarter. You’ll work under the guidance of the Major Incident Commanders. This role requires variable shifts plus responding to 24x7 critical alerts via mobile device or other connected platform The schedule for this role is Monday-Friday, 10PM - 6:30AM AZ Time. This can be a remote position if you live in the following states ONLY: Al, AK, AR, FL, GA, ID, IN, IA, KS, KY, LA, MD,MI, MN, MS, MO, NH, NM, NY, NC, ND, OH, OK, OR, PA, SC, TN, TX, UT, VA, WA, WI AZ CA CO NE NV WY. No other states will be consider. Your pay and benefits (Total Rewards) are important components of your Journey at Banner Health. Banner Health offers a variety of benefit plans to help you and your family. We provide health and financial security options, so you can focus on being the best at what you do and enjoying your life. Within Banner Health Corporate, you will have the opportunity to apply your unique experience and expertise in support of a nationally-recognized healthcare leader. We offer stimulating and rewarding careers in a wide array of disciplines. Whether your background is in Human Resources, Finance, Information Technology, Legal, Managed Care Programs or Public Relations, you'll find many options for contributing to our award-winning patient care. POSITION SUMMARY This is a mid-level position that executes the foundational elements of major incident response and supports operational readiness when incidents are not active. This role focuses on reliable execution, accurate documentation, monitoring, and adherence to established processes under the guidance of senior coordinators, incident commanders, and the Major Incident Manager. Working variable shifts and responding to 24x7 critical alerts on a mobile device or other connected platform for service disruptions is required for this role. CORE FUNCTIONS 1. Works assigned shift and participates in on-call rotation to independently coordinate major incident bridge calls and collaboration channels. Supports Major Incident Commanders as directed. 2. Reviews, validates, and maintains incident records, timelines, and activity logs. Ensures completeness, accuracy, and timely closure. 3. Publishes approved outage notifications and status updates using standard templates; ensures accuracy, timeliness, and adherence to communication standards. 4. Monitors dashboards and system alerts across designated platforms. Analyzes alert effectiveness, identifies gaps or noise, and recommends improvements. 5. Partners with Problem Management to monitor RCA completion quality, ensures findings are documented, and tracks corrective actions to closure. 6. Monitors and reports on high-priority incident response SLAs and KPIs (MTTR, incident counts, communication timeliness); escalates risks or trends as identified. 7. Reviews playbooks, contact lists, and templates for accuracy. Submits recommended updates based on observed gaps or incident learnings. 8. Maintains up-to-date knowledge of enterprise technology platforms, security policies, major incident processes, core stakeholders, and downtime procedures. Serves as a resource to Coordinator I staff. MINIMUM QUALIFICATIONS Experience and education as normally obtained through an Associate’s degree and 1 year of relevant experience in IT operations, service desk, NOC, or incident management. Demonstrated ability to independently coordinate major incidents. Experience leading incident bridges and coordinating cross-functional technical teams. Ability to assess impact, manage priorities, and maintain response cadence during active incidents. Strong written and verbal communication skills, including stakeholder-facing updates. Proven ability to multitask effectively in high-pressure environments. Ability and willingness to work variable shifts and respond to 24x7 critical alerts via mobile device or other connected platforms for service disruptions. PREFERRED QUALIFICATIONS Bachelor’s degree in Information Systems, Computer Science, Healthcare Informatics, Healthcare Administration, Business Administration, or a related field preferred. ITIL Foundation certification or equivalent practical experience. Experience publishing outage notifications and executive-level status updates. Experience analyzing incident trends or supporting continuous improvement initiatives. Experience mentoring or supporting junior coordinators. Additional related education and/or experience preferred. EEO Statement: EEO/Disabled/Veterans Our organization supports a drug-free work environment. Privacy Policy: Privacy Policy