Senior Incident Response & Forensics Engineer

HCA Healthcare, Inc.; Nashville (TN); On-site; USD 120,000 - 170,000; Full time

Job summary

HCA Healthcare is seeking a Senior Threat Response Engineer in Nashville to investigate and respond to security events, leading complex investigations from triage through containment and remediation across endpoint, identity, network, web, email, and cloud telemetry.

The role requires strong judgment with incomplete information and the ability to develop clear, supportable conclusions. You will own forensic tooling, help operate and improve tooling, coordinate with vendors, and mentor teammates.

Qualifications

• Five or more years of relevant experience in cyber incident response, digital forensics, threat response, insider threat, or security operations.
• Experience with Endpoint Detection and Response (EDR) platforms such as Microsoft Defender for Endpoint or comparable tools.
• Experience with SIEM technologies; Splunk and SPL experience are preferred.
• Experience deploying, tuning, or operating security tools and working directly with vendors to improve investigative capabilities.

Responsibilities

• Triage security detections and provide containment and remediation recommendations.
• Perform Windows artifact and forensic analysis; familiarity with Linux/macOS investigations is helpful.
• Conduct digital forensics and incident response across endpoint, identity, network, web, email, and cloud telemetry; build timelines and document conclusions.
• Maintain evidence handling, case documentation, confidentiality, and ethical use of security tools.
• Communicate findings, risk, and recommendations to technical and non-technical stakeholders, including leadership and Legal.
• Partner with Security Engineering, IAM, Networking, Endpoint, and other teams to investigate and remediate threats.
• Improve detection and investigation procedures through threat hunting and runbook development.
• Mentor and onboard analysts, lead knowledge-sharing sessions, support interviewing.

Skills

Threat detection

Incident response

Digital forensics

Security tooling

Vendor coordination

Stakeholder communication

Mentoring

Education

Bachelor’s Degree Preferred

Tools

Microsoft Defender for Endpoint

Splunk

Job description

HCA Healthcare is seeking a Senior Threat Response Engineer in Nashville to investigate and respond to security events, leading complex investigations from triage through containment and remediation across endpoint, identity, network, web, email, and cloud telemetry.

The role requires strong judgment with incomplete information and the ability to develop clear, supportable conclusions. You will own forensic tooling, help operate and improve tooling, coordinate with vendors, and mentor teammates.