Healthcare Security Incident Response Lead

Accendra Health; North Carolina; On-site; USD 57,000 - 95,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Paid time off plan

401(k) Plan

Flexible Spending Accounts

Life insurance

Disability coverage

Parental leave

Domestic partner benefits

Well‑being programs

Job summary

Accendra Health seeks an L3 Security Incident Response Analyst to own incidents end‑to‑end in a regulated healthcare environment, handling PHI/PII and coordinating with Privacy, Compliance, and Legal.

You will lead high‑severity investigations across endpoints, identity, email, network, and cloud; develop detections, drive containment, and mentor L1/L2 analysts to improve overall security posture.

Qualifications

• 5+ years in security operations or incident response, with at least 2 years leading investigations independently on high‑severity incidents.
• Deep, practical expertise in: SIEM/detection engineering, identity and access, email security, endpoint, and network security.
• Fluency with MITRE ATT&CK and the ability to map observed activity to it.
• Experience investigating incidents involving PHI/PII or other regulated data, including scoping data exposure.

Responsibilities

• Lead high‑severity investigations across endpoint, identity, email, network, cloud, and SaaS telemetry; build and defend a timeline and root cause, not just a list of alerts.
• Make and execute containment decisions: session revocation, credential resets, token invalidation, host isolation, mailbox rule removal, conditional access changes, and network blocks.
• Run eradication and recovery, verify the adversary is actually out, and confirm persistence mechanisms are removed.
• Perform log analysis and light forensics and preserve evidence to a standard that survives regulatory review.
• Coordinate with Privacy, Compliance, and Legal to feed incident facts into breach determination and notification decisions.
• Tune and build SIEM detections and response playbooks; reduce false positives and dwell time.
• Mentor L1/L2 analysts and participate in on‑call rotation and tabletop exercises.

Job description

Accendra Health seeks an L3 Security Incident Response Analyst to own incidents end‑to‑end in a regulated healthcare environment, handling PHI/PII and coordinating with Privacy, Compliance, and Legal.

You will lead high‑severity investigations across endpoints, identity, email, network, and cloud; develop detections, drive containment, and mentor L1/L2 analysts to improve overall security posture.