Senior Incident Response Analyst

The role

You will own tier-1 and tier-2 incidents end to end, including detection, triage, containment, and recovery. You will perform forensic investigations across host, memory, network, cloud, and identity systems.

What you will do

• Own tier-1 and tier-2 incidents end to end
• Run host, memory, network, cloud, and identity forensic investigations independently
• Investigate from EDR and SIEM telemetry
• Share the IR on-call rotation
• Exercise named containment authority within a defined threshold
• Author and rewrite IR playbooks
• Run post-incident reviews
• Automate or AI-assist repetitive triage and evidence-collection steps
• Write technical timelines and executive summaries

Required qualifications

• 6–8 years of hands-on security experience, with the majority in incident response and/or digital forensics
• Demonstrated ownership of the full incident lifecycle
• Digital forensics breadth across host/disk, memory, network, cloud, and identity
• Working depth in EDR/EPP
• Working depth in SIEM
• Hands-on fluency with a forensic toolchain (e.g., Velociraptor, KAPE, Volatility, Autopsy/EnCase/FTK/X-Ways, plaso, Zeek, Wireshark)
• Evidence handling discipline
• MITRE ATT&CK fluency applied to real investigations
• Scripting for investigation and automation (Python, PowerShell, or similar)
• Demonstrated, hands-on use of AI tools (Claude, ChatGPT, Copilot, or equivalent) in security work
• Clear incident writing
• Willingness to participate in a shared IR on-call rotation

Nice to have

• CrowdStrike Falcon EDR
• CrowdStrike Falcon Next-Gen SIEM
• CrowdStrike Falcon Shield
• Cloud incident response in AWS
• Identity-centric investigation, particularly Okta
• Healthcare, fintech, or other regulated-industry experience with sensitive data
• HIPAA, HITRUST, or SOC 2 from the operator side
• GCFA, GCFE, GCIH, GNFA, GCIA, GREM, or equivalent demonstrated expertise
• Malware triage and reverse engineering fundamentals
• SOAR / automation platform experience, or AI-assisted IR workflows built on LLM APIs

Benefits

• Medical, Dental, and Vision plans
• Flexible Spending/Health Savings Accounts
• Flexible PTO
• 401(k) + Company Match
• Life Insurance
• Pet insurance

About the company

OpenLoop provides telehealth support solutions designed to streamline care delivery for companies offering virtual support to patients in all 50 states. The company has a relatively flat organizational structure with core values of Autonomy, Competence and Belonging.