Note: The job is a remote job and is open to candidates in USA. OpenLoop provides telehealth support solutions that help deliver virtual care at scale. The Senior Incident Response Analyst will own security incidents end to end, conduct forensic investigations across hosts, networks, cloud, and identity systems, improve incident response playbooks, and automate repetitive investigation tasks.
Responsibilities
- Own tier-1 and tier-2 incidents end to end: detection validation, triage, scoping, containment, eradication, recovery, and post-incident review
- Run host, memory, network, cloud, and identity forensic investigations independently, with evidence handling that holds up to legal, regulatory, and client scrutiny
- Investigate from EDR and SIEM telemetry — write and refine queries, build correlation logic, and reconstruct incident timelines from log data
- Share the IR on-call rotation with the Lead Incident Responder and Senior Staff Security Analyst, and exercise named containment authority (host isolation, session revocation) within a defined threshold
- Author and rewrite IR playbooks based on incidents you personally work, and run post-incident reviews with findings tracked to closure
- Automate or AI-assist repetitive triage and evidence-collection steps so the team’s time goes to investigation rather than toil
- Write for two audiences — a defensible technical timeline and an executive summary of the same incident
Skills
- 6–8 years of hands-on security experience, with the majority in incident response and/or digital forensics
- Demonstrated ownership of the full incident lifecycle, from detection validation through post-incident review
- Digital forensics breadth across host/disk, memory, network, cloud, and identity — from real casework, not coursework
- Working depth in EDR/EPP: investigating from endpoint telemetry, running response actions, and tuning what the tool surfaces
- Working depth in SIEM: query authoring, correlation logic, and timeline reconstruction from log data
- Hands-on fluency with a forensic toolchain (e.g., Velociraptor, KAPE, Volatility, Autopsy/EnCase/FTK/X-Ways, plaso, Zeek, Wireshark)
- Evidence handling discipline — chain of custody, sound acquisition, and documentation that survives legal, regulatory, and client scrutiny
- MITRE ATT&CK fluency applied to real investigations
- Scripting for investigation and automation (Python, PowerShell, or similar)
- Demonstrated, hands-on use of AI tools (Claude, ChatGPT, Copilot, or equivalent) in security work, with specific examples of their impact on speed or quality — and sound judgment about AI and sensitive data (PHI, credentials, telemetry)
- Clear incident writing: able to produce both a technical timeline and an executive summary of the same incident
- Willingness to participate in a shared IR on-call rotation
- CrowdStrike Falcon EDR — hands-on investigation and response in the console
- CrowdStrike Falcon Next-Gen SIEM — CQL query authoring, correlation rules, and dashboards
- CrowdStrike Falcon Shield — SaaS app, identity, and third-party integration risk
- Cloud incident response in AWS (CloudTrail, GuardDuty, IAM abuse patterns)
- Identity-centric investigation, particularly Okta (session hijacking, MFA fatigue, token theft, SSO abuse)
- Healthcare, fintech, or other regulated-industry experience with sensitive data
- HIPAA, HITRUST, or SOC 2 from the operator side, including breach determination workflow
- GCFA, GCFE, GCIH, GNFA, GCIA, GREM, or equivalent demonstrated expertise
- Malware triage and reverse engineering fundamentals
- SOAR / automation platform experience, or AI-assisted IR workflows built on LLM APIs
- Multi-entity or M&A environment experience — we operate across several subsidiaries
- Open-source contributions to DFIR or security tooling; CTF history, conference talks, or other community engagement
- Experience maturing an IR program from a lower baseline
- Threat intelligence consumption applied to active investigations
Benefits
- For salaried positions, eligibility for Medical, Dental, and Vision plans
- For salaried positions, eligibility for Flexible Spending/Health Savings Accounts
- For salaried positions, eligibility for Flexible PTO
- For salaried positions, eligibility for a 401(k) with company match
- For salaried positions, eligibility for Life Insurance
- For salaried positions, eligibility for Pet insurance
Company Overview