Principal DFIR & Threat Intelligence Analyst

Modernizing Medicine, Inc.; United States; On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Medical, dental, and vision benefits

401(k) with company matching

Paid time off and parental leave

Tuition reimbursement

Hybrid/remote work options

Job summary

Modernizing Medicine, Inc. (ModMed) seeks a Principal, DFIR & Threat Intelligence Analyst to lead end-to-end cyber defense, combining CTI, AI-augmented SOC monitoring, IR, digital forensics, and malware analysis.

This role covers weekend shifts (Thu–Sun) with hands-on incident response, containment, and root-cause remediation across cloud and on-prem environments. You will set detection strategies, mentor SOC staff, and brief executive leadership, while enforcing regulatory standards and

Qualifications

• 10+ years in Digital Forensics, Incident Response, SOC and Cyber Threat Intelligence.
• 3+ years as Principal/Lead/Staff overseeing enterprise breach responses.
• Experience with HIPAA/PCI DSS/SOC2/HITRUST standards and regulatory breach assessments.
• Strong knowledge of AWS (EC2/EKS), CI/CD, and enterprise identity architectures.

Responsibilities

• Incident Command, Digital Forensics & Malware Analysis during High/ Critical events.
• AI-first automation, log architecture, detection engineering and SOAR workflows.
• CTI hunting, threat surface defense, and DRP monitoring with deception assets.
• Cloud/Identity security across AWS, Okta, AD, Duo; defend pipelines and containers.
• Regulatory breach determinations; liaise with Legal and Privacy teams.
• Program leadership, metrics, MDR vendor oversight and staff upskilling.

Skills

DFIR expertise

Threat Hunting

AI-driven security

Incident response leadership

Memory forensics

Education

Bachelor's degree in Cybersecurity or related

Master's degree preferred

Tools

CrowdStrike RTR

KAPE

Volatility

FTK Imager

Velociraptor

Cribl Stream

Tines SOAR

CrowdStrike Falcon

Job description

Join the Team Modernizing Medicine

At ModMed, we’re not just building software—we’re reimagining the healthcare experience. Founded in 2010 by a practicing physician and a successful tech entrepreneur, we took a radically different approach: we hired doctors and taught them how to code. This "for doctors, by doctors" philosophy has allowed us to create an AI-enabled, specialty-specific cloud platform that places patients at the center of care.

A Culture of Excellence

When you join ModMed, you’re joining an award-winning team recognized for innovation and employee satisfaction. From our global headquarters in Boca Raton Florida, and extensive employee base in Hyderabad India, we are a team of 4,500+ passionate problem-solvers on a mission to increase medical practice success and improve patient outcomes:

• Consistently ranked as a Top Place to Work 2025


• Globee Business Awards: Gold Globee for "Technology Team of the Year" 2025


• Black Book Awards: Ranked #1 EHR in 11 Specialties


• Florida Venture Forum: Venture-Backed Company of the Year

We are growing fast, thinking big, and we are just getting started.

Job Description Summary

The Principal, DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function that unifies Cyber Threat Intelligence (CTI), AI-augmented SOC monitoring, Incident Response (IR), Digital Forensics, and Malware Analysis into a single operational pipeline. Operating with an AI-first mindset, this position provides dedicated, hands-on-keyboard coverage from Thursday through Sunday, closing the weekend dwell-time gap and independently owning High and Critical security incidents end to end. As the sole hands-on DFIR responder during weekend shifts, you will command incidents, execute machine-speed containment, conduct deep-dive memory and cloud forensics, drive root-cause remediation, and author regulatory breach-determination recommendations. While carrying no direct reports, this terminal individual contributor role holds technical authority across the enterprise, setting detection and hunting methodologies, mentoring the broader security operations team, and briefing executive leadership.

Schedule

Thursday to Sunday; 9am to 5pm EST in Boca Raton, FL

Key Responsibilities

• 1. Incident Command, Digital Forensics & Malware Analysis (25%) Direct end-to-end incident containment, host isolation, and post-incident root-cause analysis during High and Critical security events as Incident Commander. Serve as the sole weekend hands-on responder, independently owning incidents from initial detection through forensic reconstruction and post-mortem delivery. Execute real-time host isolation via CrowdStrike Real Time Response (RTR) and extract forensic artifacts across volatile memory, storage volumes (EBS, EFS, FSx, S3), container workloads (AWS EKS, ECS, Fargate), and application logs (Apache Tomcat, CI/CD, Databricks). Utilize forensic suites—including CrowdStrike Falcon Forensics, KAPE, Volatility, FTK Imager, and Velociraptor—to perform memory analysis and disk triage. Perform malware triage, dynamic/static reverse engineering, sandbox detonation, deobfuscation, and C2 extraction, translating findings into defensive YARA signatures. Enforce strict evidentiary chain-of-custody protocols and author legally defensible forensic investigation reports adhering to regulatory standards.




• 2. AI-First Automation, Detection Engineering & Log Architecture (20%) Author, tune, and operationalize multi-source correlation rules and custom Falcon Indicators of Attack (IOAs) using detection-as-code methodologies with version control and CI/CD testing. Write complex query logic across CrowdStrike Query Language (CQL), Falcon Query Language (FQL), Kusto Query Language (KQL), and SQL/Athena against AWS Security Lake (OCSF/Parquet format). Ingest, transform, and optimize high-volume security telemetry using Cribl Stream and Axonius (CAASM) pipelines. Build and maintain automated orchestration workflows using Tines SOAR, CrowdStrike Fusion SOAR, serverless Python tools, and multi-agent AI investigation platforms (custom agents, prompts, and skills) to accelerate analyst triage. Map detection coverage systematically against MITRE ATT&CK and MITRE D3FEND frameworks to run gap analyses and harden defenses.




• 3. Cyber Threat Intelligence (CTI), Hunting & Threat Surface Defense (20%) Execute the complete intelligence lifecycle against Priority Intelligence Requirements (PIRs)—collection, processing, analysis, dissemination, and feedback—using structured analytic techniques (Diamond Model, Cyber Kill Chain, Analysis of Competing Hypotheses). Design and conduct hypothesis-driven, TTP-based threat hunts evaluated against the Hunting Maturity Model to uncover advanced adversary presence and living-off-the-land techniques. Direct Digital Risk Protection (DRP): monitor underground forums, track unauthorized code commits and secret leaks in external repositories, and manage domain takedowns. Deploy and monitor Thinkst Canary honeytokens and deception assets to detect early-stage reconnaissance and lateral movement. Leverage AI/LLM-driven processing to convert OSINT, dark-web data, Health-ISAC feeds (STIX/TAXII), and CISA Known Exploited Vulnerabilities (KEV) into immediate blocklists and behavioral detection rules.




• 4. Cloud, Workload, Identity & SaaS Security Operations (20%) Monitor, triage, and investigate threats across a multi-region enterprise AWS footprint of 120+ accounts utilizing AWS Security Lake, CloudTrail, GuardDuty, Detective, Inspector 2, Security Hub, Config, and VPC Flow Logs. Investigate complex identity attacks, Adversary-in-the-Middle (AiTM) techniques, and MFA bypass attempts across Okta, Active Directory, Duo, and Google Workspace. Secure containerized workloads (EKS, ECS, Fargate) and core deployment pipelines (Jenkins, Octopus Deploy, Ansible, GitHub Actions). Operationalize the complete CrowdStrike Falcon platform, including NG-SIEM/LogScale, Spotlight, Discover, EASM, Identity Protection, Falcon Shield, ASPM, CSPM, FileVantage (FIM for PCI compliance), AIDR, and Data Protection/DLP. Defend email channels and investigate phishing and malware outbreaks using Abnormal AI.




• 5. Regulatory Breach Determination & Legal/Privacy Interface (15%) Own the technical breach/no-breach determination recommendation and assemble the supporting technical evidentiary package. Lead HIPAA four-factor breach risk assessments and coordinate PCI Forensic Investigation (PFI) engagements. Prepare and maintain litigation-hold evidence to forensic legal standards. Interface directly with Legal, the Privacy Officer, outside counsel, cyber-insurance carriers, and the CISO to deliver technical findings that guide statutory notification decisions (OCR, state Attorneys General, contractual SLAs).




• 6. Program Leadership, Metrics & Continuous Improvement Define, track, and optimize operational metrics: Mean Time to Detect (MTTD), Mean Time to Acknowledge (MTTA), Mean Time to Respond (MTTR), containment time, and adversary dwell time. Translate post-incident lessons learned directly into detection engineering and infrastructure hardening loops. Manage Managed Detection and Response (MDR) vendor performance (ReliaQuest) and direct proof-of-concept evaluations for emerging security technologies. Facilitate purple-team exercises, tabletop simulations, and adversary-emulation tests to validate detection fidelity. Mentor and upskill SOC analysts on AI-assisted investigations and modern digital forensics to eliminate single-person dependencies across the team.

Qualifications

• Minimum Requirements Education & Experience: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or a related technical discipline (or equivalent practical experience).


• Military & Veteran Substitution: Equivalent military experience in cyber operations, network defense, or signals intelligence (e.g., Army 17C/25D, Navy CTN, Air Force 1B4X1/1D7X1, USMC 17XX, or equivalent Space Force/Coast Guard cyber specializations across Active, Guard, or Reserve) fully substitutes for the degree requirement.


• 10+ years of progressive, hands‑on experience in Digital Forensics, Incident Response (DFIR), SOC operations, and Cyber Threat Intelligence.


• 3+ years acting in a Principal, Lead, or Staff capacity overseeing complex enterprise breach responses and crisis command.


• Incident Command & Forensics: Proven record commanding High/Critical enterprise incidents; hands‑on expertise with host isolation (CrowdStrike RTR), memory analysis, storage volume forensics (EBS, EFS, FSx, S3), and container investigations under HIPAA, PCI DSS, SOC 2, or HITRUST standards.


• Cloud & Identity Mastery: Deep experience analyzing telemetry across large AWS organizations (100+ accounts), containerized environments (EKS), CI/CD pipelines, and enterprise identity architectures (Okta, Active Directory, Duo).


• Automation & Engineering: Proficient in engineering detection logic and queries in CQL, FQL, KQL, and SQL (Athena/OCSF), with scripting/automation capability in Python, PowerShell, or Bash.


• Threat Surface Defense: Proven experience designing hypothesis‑driven threat hunts, directing Digital Risk Protection (secret leak tracking, domain takedowns), deploying deception networks (Thinkst Canary), and operationalizing CTI (Health-ISAC, CISA KEV).


• Schedule Requirement: Ability and willingness to work a dedicated weekend schedule (Thursday through Sunday) as the primary DFIR responder.

Preferred Qualifications

• Master’s degree in Cybersecurity, Computer Science, or related technical field. Industry certifications: Core DFIR: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH). Cloud & Governance: AWS Certified Security - Specialty, GIAC Cloud Security Automation (GCSA), CCSP, CISSP. AI & Automation: GIAC AI Security Automation Engineer (GASAE), GIAC Machine Learning Engineer (GMLE). CrowdStrike: CrowdStrike Certified Falcon Hunter (CCFH), Falcon Responder (CCFR), or Falcon Administrator (CCFA). Experience administering Tines SOAR, CrowdStrike Fusion SOAR, Cribl Stream, or building agentic LLM investigation workflows. Direct experience handling regulatory breach risk evaluations (HIPAA 4-factor assessments, PFI investigations) in a healthcare technology or SaaS environment.

ModMed Benefits Highlight

• United States Comprehensive medical, dental, and vision benefits, including a company Health Savings Account contribution, 401(k): ModMed provides a matching contribution each payday of 50% of your contribution deferred on up to 6% of your compensation. After one year of employment with ModMed, 100% of any matching contribution you receive is yours to keep. Generous Paid Time Off and Paid Parental Leave programs, Company paid Life and Disability benefits, Flexible Spending Account, and Employee Assistance Programs, Company-sponsored Business Resource & Special Interest Groups that provide engaged and supportive communities within ModMed, Professional development opportunities, including tuition reimbursement programs and unlimited access to LinkedIn Learning, Global presence and in‑person collaboration opportunities; dog‑friendly HQ (US), Hybrid office‑based roles and remote availability for some roles, Weekly catered breakfast and lunch, treadmill workstations, Zen, and wellness rooms within our BRIC headquarters.

It takes more than just a great product to modernize medicine. It takes a great team. The work we do makes a difference. Our web and mobile applications are transforming healthcare information technology to increase practice efficiency and improve patient outcomes. Our innovative and collaborative culture fuels our growth and creates rewarding and empowering experiences for our team.