Role Overview
The Senior Incident Response Analyst position at OpenLoop is a full-time remote role focused on managing digital forensics and incident response to protect critical clinical and operational systems. This role suits an experienced, hands-on security professional who thrives on owning complex incidents from start to finish while safeguarding patient health information.
Key Responsibilities
Manage tier-1 and tier-2 security incidents end to end, covering detection validation, triage, scoping, containment, eradication, recovery, and post-incident review.
Conduct independent forensic investigations across host, memory, network, cloud, and identity environments with rigorous evidence handling.
Analyze EDR and SIEM telemetry to write queries, build correlation logic, and reconstruct detailed incident timelines.
Participate in the shared incident response on-call rotation and exercise named containment authority within a defined threshold.
Develop and update incident response playbooks based on real casework and lead thorough post-incident reviews.
Automate and use AI tools for repetitive triage and evidence-collection tasks to optimize investigation speed.
Produce clear documentation, including defensible technical timelines and executive summaries.
Requirements
Possess 6 to 8 years of hands-on security experience with a primary focus on incident response and digital forensics.
Proven ownership of the entire incident lifecycle from detection to post-incident review.
Broad digital forensics capability covering host, disk, memory, network, cloud, and identity domains.
Working depth in EDR/EPP endpoint telemetry investigation and response actions.
Working depth in SIEM query authoring, correlation logic, and timeline reconstruction.
Fluent with standard forensic toolchains such as Velociraptor, KAPE, Volatility, and Wireshark.
Strict evidence handling discipline demonstrating sound chain of custody and documentation.
Applied fluency with the MITRE ATT&CK framework during real investigations.
Scripting skills for investigation and automation using Python, PowerShell, or similar languages.
Practical, hands-on experience utilizing AI tools in security work while maintaining sound judgment regarding sensitive data.
Excellent incident writing skills for both technical and executive audiences.
Willingness to join a shared on-call rotation.
Nice to Have
Hands-on investigation and response experience using CrowdStrike Falcon EDR, Next-Gen SIEM, and Falcon Shield.
Cloud incident response expertise in AWS, including CloudTrail, GuardDuty, and IAM abuse patterns.
Identity-centric investigation knowledge focusing on Okta and SSO abuse.
Background in regulated industries such as healthcare or fintech handling sensitive data.
Familiarity with HIPAA, HITRUST, or SOC 2 operator-side workflows and breach determinations.
Professional certifications like GCFA, GCFE, GCIH, GNFA, GCIA, or GREM.
Fundamentals in malware triage and reverse engineering.
Experience with SOAR platforms, automation, or LLM-assisted IR workflows.
Multi-entity, subsidiary, or M&A environment security experience.
Open-source contributions, CTF history, or conference speaking in the DFIR community.
Track record of maturing an incident response program from a lower baseline.
Experience applying threat intelligence consumption to active investigations.
Skills and Tools
Python and PowerShell scripting
AWS security monitoring (CloudTrail, GuardDuty, IAM)
EDR and SIEM telemetry analysis
Forensic tools including Velociraptor, KAPE, Volatility, and Wireshark
AI tools like Claude, ChatGPT, and Copilot
Salary and Benefits
Comprehensive medical, dental, and vision insurance plans
Flexible Spending and Health Savings Accounts
Flexible paid time off policy
401(k) retirement plan with company match
Additional coverage including life insurance and pet insurance
About the Company
OpenLoop powers telehealth solutions at scale with a vision to bring care anywhere, streamlining virtual care delivery across all 50 states. Co-founded by CEO Dr. Jon Lensing and COO Christian Williams, the organization maintains a flat structure centered around core values of autonomy, competence, and belonging.
How to Apply
Interested candidates should submit their application directly through the official OpenLoop careers page.
