Incident Response Analyst

Alignment Health•Orange, CA

2d•$64,384 - $96,577•Remote

About The Position

The Incident Response Analyst is responsible for first-line monitoring, triage, detection, and escalation of security alerts and reported phishing activity across the organization’s information systems. The role works under general direction and exercises independent judgment on day-to-day disposition and containment decisions. The analyst collaborates with Information Security staff, IT Operations, and Compliance stakeholders to protect sensitive Medicare Advantage member data under HIPAA and HITRUST frameworks. The work includes high-volume alert triage, limited containment actions, and structured incident documentation, supporting risk reduction and audit readiness while building toward threat hunting and broader detection engineering.

Requirements

1–2 years of hands-on experience in an IT, help desk, or security operations role; internship, apprenticeship, or structured lab-based security operations coursework will also be considered.
Hands-on ability to investigate an EDR alert, including reviewing process behavior and parent/child relationships, and explain why an event was escalated, closed, or acted upon through temporary host or account restriction.
Ability to independently query and correlate SIEM or log-analytics data to support an investigation.
Ability to evaluate evidence of compromise and independently decide whether to restrict or disable a host or account, weighing the consequences of action and inaction.
Ability to recognize recurring false positives or noisy alert patterns and implement narrowly scoped, reasoned tuning changes.
Ability to identify threat-intelligence items relevant to the organization, explain their significance, and add confirmed indicators to an appropriate blocklist or filtering policy.
Ability to use AI-assisted tools effectively and understand their limitations, validating AI-generated output before relying on it.
Ability to demonstrate alert triage, narrowly scoped tuning, containment decision-making, foundational threat hunting, and threat-intelligence application through practical application.
Associate degree in Computer Science, Information Security, or a related technical discipline, and/or equivalent demonstrated work experience.
Familiarity with NIST SP 800-61 as a baseline for incident documentation and lifecycle management.
Understanding of HIPAA Security Rule requirements for protecting electronic Protected Health Information (ePHI).
Proficiency in cyber incident response, including detecting, investigating, and responding to cyber attacks or unauthorized access to sensitive data systems.
Ability to independently query and correlate logs in platforms such as Splunk, Microsoft Sentinel, Rapid7 InsightIDR, or Elastic Security.
Hands-on EDR platform experience with tools such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint, including process behavior analysis and containment actions.
Ability to assess and triage emerging vulnerabilities (CVEs) and apply indicators of compromise to blocklists and filtering policies.
Analytical judgment, sound decision-making under time pressure, and willingness to ask clarifying questions rather than close items prematurely.
Discipline to document the reasoning behind dispositions so another analyst or auditor can follow the record.
Professional integrity, fortitude, honesty, and dedication.
Excellent oral and written communication skills, including the ability to communicate technical details clearly to non-technical users.
Ability to meet the described physical functions, with reasonable accommodations as applicable.

Nice To Haves

Prior experience in healthcare, health insurance, or another regulated industry, including HIPAA, HITECH, or HITRUST environments.
Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or a related discipline.
Completion of SANS/GIAC coursework, CompTIA cybersecurity training, or equivalent self-study with demonstrated lab application.
Familiarity with vulnerability assessment tools such as Rapid7 InsightVM, Tenable, or Qualys.

Responsibilities

Monitor and investigate EDR alerts, determine investigative paths and depth within documented escalation criteria, and record evidence reviewed and the reasoning behind each disposition.
Assess evidence of compromise and, when warranted, restrict or disable a host or account without waiting for approval; promptly notify senior Information Security staff of the action and rationale.
Investigate reported or suspicious email using the email security platform to validate sender reputation, headers, and links, and determine whether it is malicious or benign.
Query and correlate SIEM or log-analytics platform data to support alert triage, incident investigations, and ad hoc security requests.
Monitor threat-intelligence feeds and healthcare sector ISACs, add confirmed malicious indicators to blocklists, and propose broader architectural tuning changes for senior staff review.
Implement narrowly scoped EDR and SIEM tuning changes, document them, and build toward structured, hypothesis-driven threat hunting during low-volume periods.
Document incidents and investigations in the team’s incident-tracking system using NIST SP 800-61 methodology, including factual, auditable details and reasoned recommendations when escalating.
Stay current on HIPAA, HITRUST, the NIST Cybersecurity Framework, and CIS Controls as they apply to daily triage, and perform work in accordance with contractual, regulatory, and legal obligations.
Respond to occasional critical security alerts after hours, following defined escalation procedures.
Normalize, triage, and route incoming Information Security tickets in a timely manner, treating each new ticket as potentially availability-impacting until triaged.
Participate in Information Security team stand-ups, tabletop exercises, and periodic peer review of closed tickets.