Weekend DFIR Lead & Threat Intelligence Architect

ModMed; Boca Raton (FL); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Medical, Dental, Vision coverage

401(k) with match

Paid Time Off & Parental Leave

Life & Disability Insurance

Tuition reimbursement

Hybrid/Remote options

Dog-friendly HQ

Job summary

ModMed seeks a Principal, DFIR & Threat Intelligence Analyst to lead end-to-end cyber defense, integrating CTI, AI-augmented SOC monitoring, IR, forensics, and malware analysis. You will own High and Critical incidents during Thursday–Sunday weekend shifts, driving containment and remediation with strict chain-of-custody.

You will mentor SOC staff, define detection strategies, and coordinate with Legal/Privacy for regulatory breach determinations.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or equivalent practical experience.
• 10+ years of hands-on DFIR, SOC, and Threat Intelligence.
• Experience leading complex breach responses and crisis command.
• Ability to work a weekend schedule (Thu–Sun) as primary DFIR responder.

Responsibilities

• Direct end-to-end incident containment, host isolation, and post-incident root-cause analysis for High/Critical events.
• Sole weekend hands-on responder; own incidents from detection to post-mortem delivery.
• Perform memory and cloud forensics across AWS services and containers; extract artifacts.
• Develop and tune detection logic, hunt techniques, and MITRE mappings; mentor SOC analysts.
• Interface with Legal and Privacy to support breach determinations and regulatory reporting.

Skills

Incident Command

Digital Forensics

Malware Analysis

AI-First Automation

Detection Engineering

Log Architecture

Cloud Security

Identity & IAM

Regulatory Compliance

Threat Intelligence

Mentoring

Education

Bachelor’s degree in Cybersecurity/Related Field

Equivalent military cyber ops experience

Tools

CrowdStrike RTR

KAPE

Volatility

FTK Imager

Velociraptor

Cribl Stream

Axonius

Tines SOAR

CrowdStrike Fusion SOAR

KQL / SQL (Athena/OCSF)

Job description

ModMed seeks a Principal, DFIR & Threat Intelligence Analyst to lead end-to-end cyber defense, integrating CTI, AI-augmented SOC monitoring, IR, forensics, and malware analysis. You will own High and Critical incidents during Thursday–Sunday weekend shifts, driving containment and remediation with strict chain-of-custody.

You will mentor SOC staff, define detection strategies, and coordinate with Legal/Privacy for regulatory breach determinations.