Principal DFIR & Threat Intelligence Analyst

Modernizing Medicine•Boca Raton, FL

7d•Onsite

About The Position

The Principal, DFIR & Threat Intelligence Analyst serves as the final technical authority and hands-on technical lead for an end-to-end cyber defense function integrating cyber threat intelligence, AI-augmented SOC monitoring, incident response, digital forensics, and malware analysis. The role independently commands High and Critical security incidents, with dedicated Thursday-through-Sunday coverage to address the weekend response gap. The analyst performs machine-speed containment, deep-dive memory and cloud forensics, root-cause remediation, and regulatory breach-determination recommendations. This is a terminal individual-contributor position with no direct reports, but it sets enterprise detection and hunting methodologies, mentors the security operations team, and briefs executive leadership. The position is scheduled Thursday through Sunday, 9 a.m. to 5 p.m. EST, in Boca Raton, Florida. It covers incident command and forensic investigations; AI-first automation and detection engineering; threat intelligence and hunting; AWS, identity, workload, and SaaS security; regulatory breach determinations; and operational metrics and continuous improvement. The role also coordinates with Legal, Privacy, outside counsel, cyber-insurance carriers, and the CISO, and manages MDR vendor performance and security-technology evaluations.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or a related technical discipline, or equivalent practical experience.
Equivalent military experience in cyber operations, network defense, or signals intelligence may substitute for the degree requirement.
At least 10 years of progressive hands-on experience in digital forensics, incident response, SOC operations, and cyber threat intelligence.
At least 3 years in a Principal, Lead, or Staff capacity overseeing complex enterprise breach responses and crisis command.
Demonstrated experience commanding High or Critical enterprise incidents.
Hands-on expertise with CrowdStrike RTR host isolation, memory analysis, storage-volume forensics, and container investigations under HIPAA, PCI DSS, SOC 2, or HITRUST standards.
Deep experience analyzing telemetry across large AWS organizations with 100 or more accounts, containerized EKS environments, CI/CD pipelines, and enterprise identity architectures such as Okta, Active Directory, and Duo.
Proficiency engineering detection logic and queries in CQL, FQL, KQL, and SQL (Athena/OCSF).
Scripting and automation capability in Python, PowerShell, or Bash.
Experience designing hypothesis-driven threat hunts and directing digital risk protection, including secret-leak tracking and domain takedowns.
Experience deploying deception networks such as Thinkst Canary and operationalizing CTI sources such as Health-ISAC and CISA KEV.
Ability and willingness to work a dedicated Thursday-through-Sunday schedule as the primary DFIR responder.

Nice To Haves

Master’s degree in Cybersecurity, Computer Science, or a related technical field.
GIAC Certified Forensic Analyst (GCFA) or GIAC Certified Incident Handler (GCIH) certification.
AWS Certified Security – Specialty, GIAC Cloud Security Automation (GCSA), CCSP, or CISSP certification.
GIAC AI Security Automation Engineer (GASAE) or GIAC Machine Learning Engineer (GMLE) certification.
CrowdStrike Certified Falcon Hunter (CCFH), Falcon Responder (CCFR), or Falcon Administrator (CCFA) certification.
Experience administering Tines SOAR, CrowdStrike Fusion SOAR, or Cribl Stream, or building agentic LLM investigation workflows.
Direct experience handling regulatory breach risk evaluations, including HIPAA four-factor assessments and PFI investigations, in a healthcare technology or SaaS environment.

Responsibilities

Command High and Critical security incidents end to end, including containment, host isolation, forensic reconstruction, root-cause analysis, and post-incident reporting.
Serve as the sole hands-on DFIR responder during weekend shifts and own incidents from initial detection through post-mortem delivery.
Collect and analyze forensic artifacts from volatile memory, storage volumes, container workloads, and application logs using tools such as CrowdStrike Falcon Forensics, KAPE, Volatility, FTK Imager, and Velociraptor.
Perform malware triage, static and dynamic reverse engineering, sandbox detonation, deobfuscation, and command-and-control extraction; translate findings into defensive YARA signatures.
Maintain evidentiary chain of custody and prepare legally defensible forensic reports.
Develop and operationalize multi-source correlation rules and custom Falcon Indicators of Attack using detection-as-code, version control, and CI/CD testing.
Write detection and investigation queries in CQL, FQL, KQL, and SQL/Athena against AWS Security Lake data.
Ingest, transform, and optimize security telemetry using Cribl Stream and Axonius pipelines.
Build and maintain automated workflows with Tines SOAR, CrowdStrike Fusion SOAR, serverless Python tools, and AI investigation platforms.
Map detection coverage to MITRE ATT&CK and MITRE D3FEND and conduct gap analyses.
Execute the cyber threat intelligence lifecycle against Priority Intelligence Requirements using structured analytic techniques.
Design and conduct hypothesis-driven, TTP-based threat hunts and assess them against the Hunting Maturity Model.
Direct digital risk protection, including underground forum monitoring, external repository secret-leak tracking, and domain takedowns.
Deploy and monitor Thinkst Canary honeytokens and deception assets.
Use AI/LLM-driven processing to turn OSINT, dark-web data, Health-ISAC feeds, and CISA KEV information into blocklists and detection rules.
Monitor and investigate threats across a multi-region AWS environment using AWS Security Lake, CloudTrail, GuardDuty, Detective, Inspector 2, Security Hub, Config, and VPC Flow Logs.
Investigate identity attacks, Adversary-in-the-Middle techniques, and MFA bypass attempts across Okta, Active Directory, Duo, and Google Workspace.
Secure container workloads and deployment pipelines, including EKS, ECS, Fargate, Jenkins, Octopus Deploy, Ansible, and GitHub Actions.
Operationalize the CrowdStrike Falcon platform and investigate email threats and malware outbreaks using Abnormal AI.
Make technical breach/no-breach determination recommendations and assemble supporting evidence.
Lead HIPAA four-factor breach risk assessments, coordinate PCI Forensic Investigator engagements, and maintain litigation-hold evidence.
Present technical findings to Legal, the Privacy Officer, outside counsel, cyber-insurance carriers, and the CISO to support notification decisions.
Define and optimize MTTD, MTTA, MTTR, containment-time, and adversary-dwell-time metrics.
Turn incident lessons into detection engineering and infrastructure-hardening improvements.
Manage MDR vendor performance and lead proof-of-concept evaluations for emerging security technologies.
Facilitate purple-team exercises, tabletop simulations, and adversary-emulation tests.
Mentor and upskill SOC analysts in AI-assisted investigations and modern digital forensics.

Benefits

Comprehensive medical, dental, and vision benefits.
Company Health Savings Account contribution.
401(k) matching contribution of 50% of employee contributions deferred on up to 6% of compensation; matching contributions vest after one year of employment.
Paid time off.
Paid parental leave.
Company-paid life and disability benefits.
Flexible Spending Account.
Employee Assistance Programs.
Company-sponsored Business Resource and Special Interest Groups.
Professional development opportunities, including tuition reimbursement and unlimited access to LinkedIn Learning.
Global presence and in-person collaboration opportunities.
Dog-friendly U.S. headquarters.
Hybrid office-based roles and remote availability for some roles.
Weekly catered breakfast and lunch.
Treadmill workstations, Zen spaces, and wellness rooms at the BRIC headquarters.