Principal Cyber Security Analyst

ModMed; Boca Raton (FL); Hybrid; USD 180.000 - 240.000; Vollzeit

Benefits dieser Stelle

Medical, Dental, Vision coverage

401(k) with match

Paid Time Off & Parental Leave

Life & Disability Insurance

Tuition reimbursement

Hybrid/Remote options

Dog-friendly HQ

Zusammenfassung

ModMed seeks a Principal, DFIR & Threat Intelligence Analyst to lead end-to-end cyber defense, integrating CTI, AI-augmented SOC monitoring, IR, forensics, and malware analysis. You will own High and Critical incidents during Thursday–Sunday weekend shifts, driving containment and remediation with strict chain-of-custody.

You will mentor SOC staff, define detection strategies, and coordinate with Legal/Privacy for regulatory breach determinations.

Qualifikationen

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or equivalent practical experience.
• 10+ years of hands-on DFIR, SOC, and Threat Intelligence.
• Experience leading complex breach responses and crisis command.
• Ability to work a weekend schedule (Thu–Sun) as primary DFIR responder.

Aufgaben

• Direct end-to-end incident containment, host isolation, and post-incident root-cause analysis for High/Critical events.
• Sole weekend hands-on responder; own incidents from detection to post-mortem delivery.
• Perform memory and cloud forensics across AWS services and containers; extract artifacts.
• Develop and tune detection logic, hunt techniques, and MITRE mappings; mentor SOC analysts.
• Interface with Legal and Privacy to support breach determinations and regulatory reporting.

Kenntnisse

Incident Command

Digital Forensics

Malware Analysis

AI-First Automation

Detection Engineering

Log Architecture

Cloud Security

Identity & IAM

Regulatory Compliance

Threat Intelligence

Mentoring

Ausbildung

Bachelor’s degree in Cybersecurity/Related Field

Equivalent military cyber ops experience

Tools

CrowdStrike RTR

KAPE

Volatility

FTK Imager

Velociraptor

Cribl Stream

Axonius

Tines SOAR

CrowdStrike Fusion SOAR

KQL / SQL (Athena/OCSF)

Jobbeschreibung

The Principal, DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function that unifies Cyber Threat Intelligence (CTI), AI-augmented SOC monitoring, Incident Response (IR), Digital Forensics, and Malware Analysis into a single operational pipeline. Operating with an AI-first mindset, this position provides dedicated, hands-on-keyboard coverage from Thursday through Sunday, closing the weekend dwell-time gap and independently owning High and Critical security incidents end to end.

As the sole hands-on DFIR responder during weekend shifts, you will command incidents, execute machine-speed containment, conduct deep-dive memory and cloud forensics, drive root-cause remediation, and author regulatory breach-determination recommendations. While carrying no direct reports, this terminal individual contributor role holds technical authority across the enterprise, setting detection and hunting methodologies, mentoring the broader security operations team, and briefing executive leadership.

Key Responsibilities

1. Incident Command, Digital Forensics & Malware Analysis (25%)

• Direct end-to-end incident containment, host isolation, and post-incident root-cause analysis during High and Critical security events as Incident Commander.
• Serve as the sole weekend hands-on responder, independently owning incidents from initial detection through forensic reconstruction and post-mortem delivery.
• Execute real-time host isolation via CrowdStrike Real Time Response (RTR) and extract forensic artifacts across volatile memory, storage volumes (EBS, EFS, FSx, S3), container workloads (AWS EKS, ECS, Fargate), and application logs (Apache Tomcat, CI/CD, Databricks).
• Utilize forensic suites—including CrowdStrike Falcon Forensics, KAPE, Volatility, FTK Imager, and Velociraptor—to perform memory analysis and disk triage.
• Perform malware triage, dynamic/static reverse engineering, sandbox detonation, deobfuscation, and C2 extraction, translating findings into defensive YARA signatures.
• Enforce strict evidentiary chain-of-custody protocols and author legally defensible forensic investigation reports adhering to regulatory standards.

2. AI-First Automation, Detection Engineering & Log Architecture (20%)

• Author, tune, and operationalize multi-source correlation rules and custom Falcon Indicators of Attack (IOAs) using detection-as-code methodologies with version control and CI/CD testing.
• Write complex query logic across CrowdStrike Query Language (CQL), Falcon Query Language (FQL), Kusto Query Language (KQL), and SQL/Athena against AWS Security Lake (OCSF/Parquet format).
• Ingest, transform, and optimize high-volume security telemetry using Cribl Stream and Axonius (CAASM) pipelines.
• Build and maintain automated orchestration workflows using Tines SOAR, CrowdStrike Fusion SOAR, serverless Python tools, and multi-agent AI investigation platforms (custom agents, prompts, and skills) to accelerate analyst triage.
• Map detection coverage systematically against MITRE ATT&CK and MITRE D3FEND frameworks to run gap analyses and harden defenses.
• Execute the complete intelligence lifecycle against Priority Intelligence Requirements (PIRs)—collection, processing, analysis, dissemination, and feedback—using structured analytic techniques (Diamond Model, Cyber Kill Chain, Analysis of Competing Hypotheses).
• Design and conduct hypothesis-driven, TTP-based threat hunts evaluated against the Hunting Maturity Model to uncover advanced adversary presence and living-off-the-land techniques.
• Direct Digital Risk Protection (DRP): monitor underground forums, track unauthorized code commits and secret leaks in external repositories, and manage domain takedowns.
• Deploy and monitor Thinkst Canary honeytokens and deception assets to detect early-stage reconnaissance and lateral movement.
• Leverage AI/LLM-driven processing to convert OSINT, dark-web data, Health-ISAC feeds (STIX/TAXII), and CISA Known Exploited Vulnerabilities (KEV) into immediate blocklists and behavioral detection rules.

4. Cloud, Workload, Identity & SaaS Security Operations (20%)

• Monitor, triage, and investigate threats across a multi-region enterprise AWS footprint of 120+ accounts utilizing AWS Security Lake, CloudTrail, GuardDuty, Detective, Inspector 2, Security Hub, Config, and VPC Flow Logs.
• Investigate complex identity attacks, Adversary-in-the-Middle (AiTM) techniques, and MFA bypass attempts across Okta, Active Directory, Duo, and Google Workspace.
• Secure containerized workloads (EKS, ECS, Fargate) and core deployment pipelines (Jenkins, Octopus Deploy, Ansible, GitHub Actions).
• Operationalize the complete CrowdStrike Falcon platform, including NG-SIEM/LogScale, Spotlight, Discover, EASM, Identity Protection, Falcon Shield, ASPM, CSPM, FileVantage (FIM for PCI compliance), AIDR, and Data Protection/DLP.
• Defend email channels and investigate phishing and malware outbreaks using Abnormal AI.

5. Regulatory Breach Determination & Legal/Privacy Interface (15%)

• Own the technical breach/no-breach determination recommendation and assemble the supporting technical evidentiary package.
• Lead HIPAA four-factor breach risk assessments and coordinate PCI Forensic Investigation (PFI) engagements.
• Prepare and maintain litigation-hold evidence to forensic legal standards.
• Interface directly with Legal, the Privacy Officer, outside counsel, cyber-insurance carriers, and the CISO to deliver technical findings that guide statutory notification decisions (OCR, state Attorneys General, contractual SLAs).
• Define, track, and optimize operational metrics: Mean Time to Detect (MTTD), Mean Time to Acknowledge (MTTA), Mean Time to Respond (MTTR), containment time, and adversary dwell time.
• Translate post-incident lessons learned directly into detection engineering and infrastructure hardening loops.
• Manage Managed Detection and Response (MDR) vendor performance (ReliaQuest) and direct proof-of-concept evaluations for emerging security technologies.
• Facilitate purple-team exercises, tabletop simulations, and adversary-emulation tests to validate detection fidelity.
• Mentor and upskill SOC analysts on AI-assisted investigations and modern digital forensics to eliminate single-person dependencies across the team.

Qualifications

• Education & Experience:
• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or a related technical discipline (or equivalent practical experience).
• Military & Veteran Substitution: Equivalent military experience in cyber operations, network defense, or signals intelligence (e.g., Army 17C/25D, Navy CTN, Air Force 1B4X1/1D7X1, USMC 17XX, or equivalent Space Force/Coast Guard cyber specializations across Active, Guard, or Reserve) fully substitutes for the degree requirement.
• 10+ years of progressive, hands-on experience in Digital Forensics, Incident Response (DFIR), SOC operations, and Cyber Threat Intelligence.
• 3+ years acting in a Principal, Lead, or Staff capacity overseeing complex enterprise breach responses and crisis command.
• Incident Command & Forensics: Proven record commanding High/Critical enterprise incidents; hands-on expertise with host isolation (CrowdStrike RTR), memory analysis, storage volume forensics (EBS, EFS, FSx, S3), and container investigations under HIPAA, PCI DSS, SOC 2, or HITRUST standards.
• Cloud & Identity Mastery: Deep experience analyzing telemetry across large AWS organizations (100+ accounts), containerized environments (EKS), CI/CD pipelines, and enterprise identity architectures (Okta, Active Directory, Duo).
• Automation & Engineering: Proficient in engineering detection logic and queries in CQL, FQL, KQL, and SQL (Athena/OCSF), with scripting/automation capability in Python, PowerShell, or Bash.
• Threat Surface Defense: Proven experience designing hypothesis-driven threat hunts, directing Digital Risk Protection (secret leak tracking, domain takedowns), deploying deception networks (Thinkst Canary), and operationalizing CTI (Health-ISAC, CISA KEV).
• Schedule Requirement: Ability and willingness to work a dedicated weekend schedule (Thursday through Sunday) as the primary DFIR responder.

Preferred Qualifications

• Master’s degree in Cybersecurity, Computer Science, or related technical field.
• Industry certifications:
• Core DFIR: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH).
• Cloud & Governance: AWS Certified Security - Specialty, GIAC Cloud Security Automation (GCSA), CCSP, CISSP.
• Experience administering Tines SOAR, CrowdStrike Fusion SOAR, Cribl Stream, or building agentic LLM investigation workflows.
• Direct experience handling regulatory breach risk evaluations (HIPAA 4-factor assessments, PFI investigations) in a healthcare technology or SaaS environment.

ModMed Benefits Highlight:

At ModMed, we believe it’s important to offer a competitive benefits package designed to meet the diverse needs of our growing workforce. Eligible Modernizers can enroll in a wide range of benefits:

United States

• Comprehensive medical, dental, and vision benefits, including a company Health Savings Account contribution,
• 401(k): ModMed provides a matching contribution each payday of 50% of your contribution deferred on up to 6% of your compensation. After one year of employment with ModMed, 100% of any matching contribution you receive is yours to keep.
• Generous Paid Time Off and Paid Parental Leave programs,
• Company paid Life and Disability benefits, Flexible Spending Account, and Employee Assistance Programs,
• Company-sponsored Business Resource & Special Interest Groups that provide engaged and supportive communities within ModMed,
• Professional development opportunities, including tuition reimbursement programs and unlimited access to LinkedIn Learning,
• Global presence and in-person collaboration opportunities; dog-friendly HQ (US), Hybrid office-based roles and remote availability for some roles,
• Weekly catered breakfast and lunch, treadmill workstations, Zen, and wellness rooms within our BRIC headquarters.