openloophealth - Senior Incident Response Analyst

• You’re a hands-on responder who has led real incidents under real ambiguity, and you’re straight about what you got wrong. We hire for the discipline, not the tool SKU or the credential: no specific degree is required, and strong responders from Defender, SentinelOne, Splunk, or Sentinel environments are fully in scope. This is an individual contributor role. • 6–8 years of hands-on security experience, with the majority in incident response and/or digital forensics. • Demonstrated ownership of the full incident lifecycle, from detection validation through post-incident review. • Digital forensics breadth across host/disk, memory, network, cloud, and identity — from real casework, not coursework. • Working depth in EDR/EPP: investigating from endpoint telemetry, running response actions, and tuning what the tool surfaces. • Working depth in SIEM: query authoring, correlation logic, and timeline reconstruction from log data. • Hands-on fluency with a forensic toolchain (e.g., Velociraptor, KAPE, Volatility, Autopsy/EnCase/FTK/X-Ways, plaso, Zeek, Wireshark). • Evidence handling discipline — chain of custody, sound acquisition, and documentation that survives legal, regulatory, and client scrutiny. • MITRE ATT&CK fluency applied to real investigations. • Scripting for investigation and automation (Python, PowerShell, or similar). • Demonstrated, hands-on use of AI tools (Claude, ChatGPT, Copilot, or equivalent) in security work, with specific examples of their impact on speed or quality — and sound judgment about AI and sensitive data (PHI, credentials, telemetry). • Clear incident writing: able to produce both a technical timeline and an executive summary of the same incident. • Willingness to participate in a shared IR on-call rotation. • CrowdStrike Falcon EDR — hands-on investigation and response in the console. • CrowdStrike Falcon Next-Gen SIEM — CQL query authoring, correlation rules, and dashboards. • CrowdStrike Falcon Shield — SaaS app, identity, and third-party integration risk. • Cloud incident response in AWS (CloudTrail, GuardDuty, IAM abuse patterns). • Identity-centric investigation, particularly Okta (session hijacking, MFA fatigue, token theft, SSO abuse). • Healthcare, fintech, or other regulated-industry experience with sensitive data. • HIPAA, HITRUST, or SOC 2 from the operator side, including breach determination workflow. • GCFA, GCFE, GCIH, GNFA, GCIA, GREM, or equivalent demonstrated expertise. • Malware triage and reverse engineering fundamentals. • SOAR / automation platform experience, or AI-assisted IR workflows built on LLM APIs. • Multi-entity or M&A environment experience — we operate across several subsidiaries. • Open-source contributions to DFIR or security tooling; CTF history, conference talks, or other community engagement. • Experience maturing an IR program from a lower baseline. • Threat intelligence consumption applied to active investigations. • WHAT SUCCESS LOOKS LIKE • In your first 6 months: fully onboarded and taking primary responder duty on a defined rotation, independently owning tier-1 and tier-2 incidents without escalation for routine cases. • Forensic capability is genuinely two-deep — you can run a host, memory, cloud, or identity investigation without the Lead Incident Responder in the room. • At least three IR playbooks rewritten or newly authored from incidents you worked, with post-incident reviews running on a consistent cadence and findings tracked to closure. • In your first 12 months: measurable reduction in MTTD and MTTR against baseline, with repetitive triage and evidence collection automated or AI-assisted rather than manual.