Incident Response Analyst

Alignment Healthcare•Orange, CA

16h•Remote

About The Position

The Incident Response Analyst is responsible for first-line monitoring, triage, detection, and escalation of security alerts and reported phishing activity across Alignment Health’s information systems. Working under general direction, the analyst uses independent judgment for routine alert dispositions and containment decisions, collaborating with Information Security, IT Operations, and Compliance to protect sensitive Medicare Advantage member data under HIPAA and HITRUST frameworks. The role manages high-volume alert triage, limited containment actions, and structured incident documentation to reduce risk and support audit readiness, while progressing toward threat hunting and broader detection engineering.

Requirements

1–2 years of hands-on experience in an IT, help desk, or security operations role; security operations internship, apprenticeship, or structured lab-based coursework will also be considered.
Hands-on ability to investigate security alerts using an EDR platform, including reviewing process behavior and parent/child relationships and explaining escalation, closure, or containment decisions.
Ability to independently query and correlate SIEM or log-analytics data to support investigations.
Ability to evaluate evidence of compromise and independently decide whether to restrict or disable a host or account, weighing the consequences of action and inaction.
Ability to recognize recurring false positives or noisy alert patterns and implement a narrowly scoped, reasoned tuning change.
Ability to identify threat-intelligence items relevant to the organization, explain their significance, and add confirmed indicators to an appropriate blocklist or filtering policy.
Ability to use AI-assisted tools effectively and validate AI-generated output before relying on it.
Ability to demonstrate alert triage, narrowly scoped tuning, containment decision-making, foundational threat hunting, and threat-intelligence application through practical application.
Associate degree in Computer Science, Information Security, or a related technical discipline, and/or equivalent demonstrated work experience.
Familiarity with NIST SP 800-61 as a baseline for incident documentation and lifecycle management.
Understanding of HIPAA Security Rule requirements for protecting electronic Protected Health Information (ePHI).
Analytical judgment, sound decision-making under time pressure, and willingness to ask clarifying questions rather than close items prematurely.
Ability to document reasoning behind dispositions in a way another analyst or auditor can follow.
Professional integrity, honesty, fortitude, and dedication.
Excellent oral and written communication skills, including communicating technical details to non-technical users.

Nice To Haves

Prior experience in healthcare, health insurance, or another regulated industry, including HIPAA, HITECH, or HITRUST environments.
Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or a related discipline.
Completion of SANS/GIAC coursework, CompTIA cybersecurity training, or equivalent self-study with demonstrated lab application.
Familiarity with SIEM or log-analytics platforms such as Splunk, Microsoft Sentinel, Rapid7 InsightIDR, or Elastic Security.
Experience with EDR platforms such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint.
Familiarity with vulnerability assessment tools such as Rapid7 InsightVM, Tenable, or Qualys.

Responsibilities

Monitor and investigate endpoint detection and response alerts, document the process, file, or network activity reviewed, and explain the reasoning behind each disposition.
Assess evidence of compromise and, when warranted, restrict or disable a host or account without waiting for approval; promptly notify senior Information Security staff and document the action and rationale.
Investigate reported or suspicious email using the email security platform to validate sender reputation, headers, and links, and determine whether the email is malicious or benign.
Query and correlate SIEM or log-analytics data to support alert triage, incident investigations, and ad hoc security requests.
Monitor threat-intelligence feeds and healthcare sector ISACs, add confirmed malicious indicators to blocklists, and propose broader tuning changes to senior staff for review.
Make narrowly scoped EDR and SIEM tuning changes, such as suppressing confirmed false positives or adjusting basic detection rules; document changes and develop toward structured, hypothesis-driven threat hunting.
Document incidents and investigations in the incident-tracking system using NIST SP 800-61 methodology, including factual, auditable detail and reasoned recommendations when escalating.
Maintain working knowledge of HIPAA, HITRUST, the NIST Cybersecurity Framework, and CIS Controls, and perform work consistent with contractual, regulatory, and legal obligations.
Respond to occasional critical security alerts after hours according to defined escalation procedures.
Normalize, triage, and route incoming Information Security tickets promptly, treating each new ticket as potentially availability-impacting until triage indicates otherwise.
Participate in Information Security team stand-ups, tabletop exercises, and periodic peer review of closed tickets.