Senior Incident Response Analyst

Who You Are

Required Qualifications

• 6–8 years of hands-on security experience, with the majority in incident response and/or digital forensics.
• Demonstrated ownership of the full incident lifecycle, from detection validation through post-incident review.
• Digital forensics breadth across host/disk, memory, network, cloud, and identity — from real casework, not coursework.
• Working depth in EDR/EPP: investigating from endpoint telemetry, running response actions, and tuning what the tool surfaces.
• Working depth in SIEM: query authoring, correlation logic, and timeline reconstruction from log data.
• Hands-on fluency with a forensic toolchain (e.g., Velociraptor, KAPE, Volatility, Autopsy/EnCase/FTK/X-Ways, plaso, Zeek, Wireshark).
• Evidence handling discipline — chain of custody, sound acquisition, and documentation that survives legal, regulatory, and client scrutiny.
• MITRE ATT&CK fluency applied to real investigations.
• Scripting for investigation and automation (Python, PowerShell, or similar).
• Demonstrated, hands-on use of AI tools (Claude, ChatGPT, Copilot, or equivalent) in security work, with specific examples of their impact on speed or quality — and sound judgment about AI and sensitive data (PHI, credentials, telemetry).
• Clear incident writing: able to produce both a technical timeline and an executive summary of the same incident.
• Willingness to participate in a shared IR on-call rotation.

Preferred Qualifications

• CrowdStrike Falcon EDR — hands-on investigation and response in the console.
• CrowdStrike Falcon Next-Gen SIEM — CQL query authoring, correlation rules, and dashboards.
• CrowdStrike Falcon Shield — SaaS app, identity, and third-party integration risk.
• Cloud incident response in AWS (CloudTrail, GuardDuty, IAM abuse patterns).
• Identity-centric investigation, particularly Okta (session hijacking, MFA fatigue, token theft, SSO abuse).
• Healthcare, fintech, or other regulated-industry experience with sensitive data.
• HIPAA, HITRUST, or SOC 2 from the operator side, including breach determination workflow.
• GCFA, GCFE, GCIH, GNFA, GCIA, GREM, or equivalent demonstrated expertise.
• Malware triage and reverse engineering fundamentals.
• SOAR / automation platform experience, or AI-assisted IR workflows built on LLM APIs.
• Multi-entity or M&A environment experience — we operate across several subsidiaries.
• Open-source contributions to DFIR or security tooling; CTF history, conference talks, or other community engagement.
• Experience maturing an IR program from a lower baseline.
• Threat intelligence consumption applied to active investigations.

What Success Looks Like

Our Benefits

• In addition, for salaried positions you would also be eligible for:
• Medical, Dental, and Vision plans
• Flexible Spending/Health Savings Accounts
• Flexible PTO
• 401(k) + Company Match
• Life Insurance, Pet insurance, and more

Our Company