Incident Response Analyst

Incident Response Analyst

An Incident Response Analyst is sought to join a co-sourced cyber operations environment. In this setting, an external managed security service provider handles primary SOC monitoring, and the internal team manages escalated investigations through to remediation. This position will provide operational coverage, investigate security events, coordinate response activities across technical teams, and strengthen vulnerability management and data loss prevention capabilities.

Key Responsibilities

• Receive escalated alerts and tickets from the SOC, initiate investigations, determine scope and impact, and manage incidents through remediation and closure.
• Investigate malware, phishing, unexpected network connections, and other security events by reviewing SIEM logs, endpoint telemetry, affected assets, and impacted users.
• Coordinate with infrastructure, application, clinical technology, privacy, and other internal teams to contain threats and execute corrective actions.
• Participate in the rotating SOC alert and on-call coverage model.
• Execute and improve established incident response runbooks and support the continued development of operational procedures.
• Use packet capture data at network egress points to trace threats and support response actions that require internal access or credentials.
• Create, tune, and maintain custom detections and response scripts within the co-sourced security model.
• Support vulnerability management operations by researching newly disclosed CVEs, identifying affected assets, validating exposure, and assisting in the prioritization of remediation.
• Account for systems that may not appear in standard vulnerability tools, such as medical and other specialized devices, when assessing exposure.
• Review DLP alerts and policies, investigate potential data exposure events, and coordinate escalation to the privacy team when events may involve PHI or patient impact.
• Document investigations, response actions, findings, and remediation activities in ServiceNow in alignment with ITIL-based processes.

Required Qualifications

• Approximately 5-10 years of relevant cybersecurity operations experience, with hands-on incident response and SOC escalation responsibility.
• Demonstrated ability to independently investigate alerts, build a complete picture from multiple data sources, and coordinate an incident through remediation.
• Experience reading and interpreting SIEM logs; Sumo Logic experience is preferred.
• Hands-on experience with CrowdStrike for endpoint investigation, threat response, exposure research, and detection or response scripting.
• A solid foundation in vulnerability management, including practical experience assessing CVEs, identifying affected assets, interpreting scanner findings, and prioritizing remediation.
• Experience with vulnerability management platforms such as Tenable Nessus and Qualys; direct Tenable experience is preferred.
• Experience investigating DLP events and understanding how DLP policies trigger; Microsoft Purview experience is preferred.
• Working knowledge of ITIL practices and experience using ServiceNow for security operations workflows and ticket management.
• Clear communication, sound judgment, and the ability to work effectively across technical and business teams during active investigations.

Preferred Qualifications

• Experience in a healthcare environment or with security events involving PHI, medical devices, or patient-impacting systems.
• Deep vulnerability management expertise and the ability to improve prioritization practices, recommend better operating approaches, and share knowledge with other team members.
• Experience working in an operational security function where workload shifts based on active incidents and emerging threats.
• Experience authoring custom detections and developing scripts that automate or accelerate threat response.