Healthcare Security Incident Response Lead

RemainCo Personnel Holdings, LLC; Virginia (MN); Hybrid; USD 86,000 - 105,000; Full time

Benefits offered by this job

Medical benefits

Paid time off

401(k) Plan

Flexible Spending Accounts

Life insurance

Disability coverage

Parental leave

Domestic partner benefits

Well-being programs

Job summary

Accendra Health is seeking an L3 Security Incident Response Analyst to own incidents end-to-end in a regulated healthcare environment. You will lead investigations, containment, eradication, and recovery, while communicating with leadership and stakeholders. This role emphasizes PHI/PII data handling and sound containment decisions under time pressure.

The anticipated salary is up to $95,000 annually, with compensation varying by experience, skills, and location.

Qualifications

• 5+ years in security operations or incident response, with leadership of high-severity investigations.
• Deep, practical expertise in SIEM and detection engineering, including query languages and correlation logic.
• Experience with identity and access controls: Entra ID/AD, MFA, OAuth, tokens, privileged access.
• Email security expertise: BEC, phishing, mail-flow rules, DMARC/DKIM/SPF.
• Endpoint security: EDR investigations and response.
• Network security: firewall, proxy, VPN, DNS logs, data exfiltration indicators.
• Fluency with MITRE ATT&CK and mapping activity to it.
• Strong written communication, concise executive updates and detailed timelines.
• Good judgment on containment vs. escalation, explainable decisions.
• Experience handling PHI/PII or other regulated data incidents.

Responsibilities

• Lead high-severity investigations across endpoints, identity, email, network, cloud, and SaaS telemetry.
• Make and execute containment decisions with business impact in mind.
• Perform eradication and recovery and verify adversary removal.
• Analyze logs and perform light forensics; preserve evidence for regulatory review.
• Lead investigations of PHI/PII data breaches and coordinate with Privacy, Compliance, and Legal.
• Tune detections and build playbooks; reduce false positives and dwell time.
• Mentor L1/L2 analysts and maintain runbooks and escalation criteria.
• Participate in on-call rotations and tabletop exercises.

Skills

Incident response

SIEM expertise

Threat hunting

PowerShell scripting

Communication

Tools

Microsoft Sentinel

Rapid7 InsightIDR

Splunk

M365 Defender

Job description

Accendra Health is seeking an L3 Security Incident Response Analyst to own incidents end-to-end in a regulated healthcare environment. You will lead investigations, containment, eradication, and recovery, while communicating with leadership and stakeholders. This role emphasizes PHI/PII data handling and sound containment decisions under time pressure.

The anticipated salary is up to $95,000 annually, with compensation varying by experience, skills, and location.