Senior Incident Response Analyst - DFIR Specialist

OpenLoop; United States; On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical, Dental, and Vision plans

Flexible PTO

401(k) + Company Match

Life Insurance

Pet insurance

Job summary

OpenLoop is seeking a Senior Incident Response Analyst to join our Security Operations team. You will own incidents end-to-end, conduct forensic investigations across host, memory, network, cloud, and identity, and produce both technical timelines and executive summaries for complex cases.

You will refine queries, build correlation logic from EDR/SIEM data, and help automate triage with AI-assisted techniques to improve speed and quality, while supporting on-call rotations.

Qualifications

• 6–8 years of hands-on security experience, focused on incident response and/or digital forensics.

Responsibilities

• Own tier-1 and tier-2 incidents end to end: detection validation, triage, scoping, containment, eradication, recovery, and post-incident review.
• Run host, memory, network, cloud, and identity forensic investigations independently, with evidence handling that stands up to legal, regulatory, and client scrutiny.
• Investigate from EDR and SIEM telemetry — write and refine queries, build correlation logic, and reconstruct incident timelines from log data.
• Share the IR on-call rotation with the Lead Incident Responder and Senior Staff Security Analyst, and exercise named containment authority within a defined threshold.
• Author and rewrite IR playbooks based on incidents you personally work, and run post-incident reviews with findings tracked to closure.
• Automate or AI-assist repetitive triage and evidence-collection steps so the team’s time goes to investigation rather than toil.
• Write for two audiences — a defensible technical timeline and an executive summary of the same incident.

Skills

Incident response

Digital forensics

EDR/EPP

SIEM

Threat hunting

Forensic toolchain

MITRE ATT&CK

Scripting (Python/PowerShell)

AI tools in security

Incident writing

Tools

Velociraptor

KAPE

Volatility

Autopsy/EnCase/FTK/X-Ways

Wireshark

Zeek

CrowdStrike Falcon

Splunk

CloudTrail

GuardDuty

Job description

OpenLoop is seeking a Senior Incident Response Analyst to join our Security Operations team. You will own incidents end-to-end, conduct forensic investigations across host, memory, network, cloud, and identity, and produce both technical timelines and executive summaries for complex cases.

You will refine queries, build correlation logic from EDR/SIEM data, and help automate triage with AI-assisted techniques to improve speed and quality, while supporting on-call rotations.