Senior Incident Response & Forensics Specialist

openloophealth; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, vision plans

401(k) with company match

Flexible PTO

Job summary

openloophealth is seeking a hands-on Senior IR/Forensics responder to lead end-to-end incident handling within a healthcare-focused security operations team. You will own the full lifecycle for tier-1 and tier-2 cases, protecting clinical systems and patient data while driving continual forensic capability improvements.

You will conduct end-to-end investigations across host, disk, memory, network, cloud, and identity surfaces, using a modern toolchain and evidence handling that withstands legal

Qualifications

• 6-8 years of hands-on security experience focused on incident response and/or digital forensics.
• Ownership of the full incident lifecycle on real cases, from detection through post-incident review.
• Broad DFIR coverage across host/disk/memory/network/cloud/identity from operational casework.
• Experience with EDR/EPP platforms and SIEM tools, including query writing and timeline reconstruction.

Responsibilities

• Own incidents end to end: detection validation, triage, scoping, containment, eradication, recovery, and post-incident review.
• Conduct independent forensic investigations across host/disk/memory/network/cloud/identity surfaces with evidence handling suitable for legal/regulatory review.
• Investigate from endpoint detection and SIEM telemetry; write/refine queries, build correlation logic, reconstruct timelines.
• Participate in shared IR on-call rotation and exercise containment authority within escalation thresholds.
• Author and revise IR playbooks based on incidents you work; conduct post-incident reviews and track findings to closure.
• Use scripting or AI-assisted tooling to automate repetitive triage and evidence-collection steps.
• Produce defensible technical timelines and executive summaries for major incidents.

Skills

Incident response

Digital forensics

Scripting for investigation

Technical writing (dual audience)

MITRE ATT&CK fluency

Tools

Velociraptor

KAPE

Volatility

Autopsy/EnCase/FTK/X-Ways

plaso

Zeek

Wireshark

CrowdStrike Falcon EDR

Next-Gen SIEM

Falcon Shield

AWS CloudTrail

GuardDuty

Okta

Job description

openloophealth is seeking a hands-on Senior IR/Forensics responder to lead end-to-end incident handling within a healthcare-focused security operations team. You will own the full lifecycle for tier-1 and tier-2 cases, protecting clinical systems and patient data while driving continual forensic capability improvements.

You will conduct end-to-end investigations across host, disk, memory, network, cloud, and identity surfaces, using a modern toolchain and evidence handling that withstands legal