Principal DFIR & Threat Intelligence Analyst

ModMed • Boca Raton, FL

1d • Onsite

About The Position

The Principal DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function spanning Cyber Threat Intelligence (CTI), AI-augmented SOC monitoring, incident response, digital forensics, and malware analysis. This hands-on individual contributor role independently owns High and Critical security incidents, with dedicated coverage Thursday through Sunday to address weekend response needs. The role commands incidents from detection through containment, forensic reconstruction, root-cause remediation, and post-incident reporting, and prepares technical recommendations for regulatory breach determinations.

The analyst establishes detection and hunting methodologies, builds AI-assisted automation and security telemetry workflows, investigates cloud, workload, identity, and SaaS threats, and translates intelligence and incident findings into defensive measures. The position also advises executive leadership, interfaces with Legal and Privacy stakeholders, manages MDR vendor performance, supports exercises and continuous improvement, and mentors the broader security operations team. It has no direct reports.

The schedule is Thursday to Sunday, 9 a.m. to 5 p.m. EST, in Boca Raton, Florida.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or a related technical discipline, or equivalent practical experience. Equivalent military experience in specified or comparable cyber operations, network defense, or signals intelligence specialties substitutes for the degree requirement.
• At least 10 years of progressive, hands-on experience in digital forensics, incident response, SOC operations, and cyber threat intelligence.
• At least 3 years in a Principal, Lead, or Staff capacity overseeing complex enterprise breach responses and crisis command.
• Proven experience commanding High/Critical enterprise incidents and hands-on expertise with CrowdStrike RTR host isolation, memory analysis, storage-volume forensics, and container investigations under HIPAA, PCI DSS, SOC 2, or HITRUST standards.
• Deep experience analyzing telemetry across large AWS organizations of 100 or more accounts, containerized environments such as EKS, CI/CD pipelines, and enterprise identity architectures including Okta, Active Directory, and Duo.
• Proficiency engineering detection logic and queries in CQL, FQL, KQL, and SQL (Athena/OCSF), with scripting or automation capability in Python, PowerShell, or Bash.
• Proven experience designing hypothesis-driven threat hunts, directing digital risk protection, deploying deception networks such as Thinkst Canary, and operationalizing CTI sources such as Health-ISAC and CISA KEV.
• Ability and willingness to work the dedicated Thursday-through-Sunday schedule as the primary DFIR responder.

Nice To Haves

• Master’s degree in Cybersecurity, Computer Science, or a related technical field.
• GIAC Certified Forensic Analyst (GCFA) or GIAC Certified Incident Handler (GCIH).
• AWS Certified Security - Specialty, GIAC Cloud Security Automation (GCSA), CCSP, or CISSP.
• GIAC AI Security Automation Engineer (GASAE) or GIAC Machine Learning Engineer (GMLE).
• CrowdStrike Certified Falcon Hunter (CCFH), Falcon Responder (CCFR), or Falcon Administrator (CCFA).
• Experience administering Tines SOAR, CrowdStrike Fusion SOAR, or Cribl Stream, or building agentic LLM investigation workflows.
• Direct experience handling regulatory breach risk evaluations, including HIPAA four-factor assessments and PFI investigations, in a healthcare technology or SaaS environment.

Responsibilities

• Command end-to-end containment, host isolation, root-cause analysis, and post-incident response for High and Critical security incidents.
• Serve as the sole hands-on weekend DFIR responder, owning incidents from initial detection through forensic reconstruction and post-mortem delivery.
• Isolate hosts using CrowdStrike Real Time Response and collect forensic artifacts from memory, storage volumes, container workloads, and application logs.
• Perform memory analysis, disk triage, malware analysis, reverse engineering, sandbox detonation, deobfuscation, and C2 extraction; develop defensive YARA signatures from findings.
• Maintain evidentiary chain of custody and write legally defensible forensic investigation reports that adhere to regulatory standards.
• Author, tune, and operationalize multi-source correlation rules and custom Falcon Indicators of Attack using detection-as-code, version control, and CI/CD testing.
• Write queries across CQL, FQL, KQL, and SQL/Athena against AWS Security Lake data.
• Ingest, transform, and optimize security telemetry using Cribl Stream and Axonius pipelines.
• Build and maintain automated orchestration workflows using Tines SOAR, CrowdStrike Fusion SOAR, Python tools, and multi-agent AI investigation platforms.
• Map detection coverage to MITRE ATT&CK and MITRE D3FEND, conduct gap analyses, and harden defenses.
• Execute the CTI lifecycle against Priority Intelligence Requirements using structured analytic techniques.
• Design and conduct hypothesis-driven, TTP-based threat hunts and assess them against the Hunting Maturity Model.
• Direct digital risk protection, including underground-forum monitoring, external repository secret-leak and unauthorized-code monitoring, and domain takedowns.
• Deploy and monitor Thinkst Canary honeytokens and deception assets.
• Use AI/LLM-driven processing to turn OSINT, dark-web data, Health-ISAC feeds, and CISA KEV information into blocklists and behavioral detection rules.
• Monitor and investigate threats across the AWS organization using AWS security services and telemetry.
• Investigate identity attacks, AiTM techniques, and MFA bypass attempts across Okta, Active Directory, Duo, and Google Workspace.
• Secure containerized workloads and deployment pipelines.
• Operationalize the CrowdStrike Falcon platform and its listed security capabilities, including NG-SIEM/LogScale, Spotlight, Discover, EASM, Identity Protection, Falcon Shield, ASPM, CSPM, FileVantage, AIDR, and Data Protection/DLP.
• Defend email channels and investigate phishing and malware outbreaks using Abnormal AI.
• Develop technical breach/no-breach recommendations and assemble supporting evidentiary packages.
• Lead HIPAA four-factor breach risk assessments and coordinate PCI Forensic Investigation engagements.
• Prepare and maintain litigation-hold evidence to forensic legal standards.
• Work with Legal, the Privacy Officer, outside counsel, cyber-insurance carriers, and the CISO to deliver findings supporting statutory notification decisions.
• Define, track, and optimize MTTD, MTTA, MTTR, containment time, and adversary dwell-time metrics.
• Convert post-incident lessons into detection engineering and infrastructure-hardening improvements.
• Manage ReliaQuest MDR vendor performance and direct proof-of-concept evaluations for emerging security technologies.
• Facilitate purple-team exercises, tabletop simulations, and adversary-emulation tests.
• Mentor and upskill SOC analysts in AI-assisted investigations and modern digital forensics.

Benefits

• Comprehensive medical, dental, and vision benefits, including a company Health Savings Account contribution.
• 401(k) matching: 50% of contributions deferred on up to 6% of compensation, with matching contributions fully vested after one year of employment.
• Generous paid time off and paid parental leave programs.
• Company-paid life and disability benefits.
• Flexible Spending Account and Employee Assistance Programs.
• Company-sponsored Business Resource and Special Interest Groups.
• Professional development opportunities, including tuition reimbursement and unlimited access to LinkedIn Learning.
• In-person collaboration opportunities and a dog-friendly U.S. headquarters; hybrid office-based roles and remote availability for some roles are also mentioned.
• Weekly catered breakfast and lunch, treadmill workstations, Zen, and wellness rooms at the BRIC headquarters.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal