Principal DFIR & Threat Intelligence Analyst

Join the Team Modernizing Medicine At ModMed , we’re not just building software—we’re reimagining the healthcare experience. Founded in 2010 by a practicing physician and a successful tech entrepreneur, we took a radically different approach: we hired doctors and taught them how to code. This "for doctors, by doctors" philosophy has allowed us to create an AI-enabled, specialty-specific cloud platform that places patients at the center of care. A Culture of Excellence When you join ModMed, you’re joining an award-winning team recognized for innovation and employee satisfaction. From our global headquarters in Boca Raton Florida, and extensive employee base in Hyderabad India, we are a team of 4,500+ passionate problem-solvers on a mission to increase medical practice success and improve patient outcomes: Consistently ranked as a Top Place to Work 2025 Globee Business Awards: Gold Globee for “Technology Team of the Year” 2025 Black Book Awards: Ranked #1 EHR in 11 Specialties Florida Venture Forum: Venture-Backed Company of the Year We are growing fast, thinking big, and we are just getting started. Ready to modernize medicine with us? Job Description Summary: The Principal, DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function that unifies Cyber Threat Intelligence (CTI), AI-augmented SOC monitoring, Incident Response (IR), Digital Forensics, and Malware Analysis into a single operational pipeline. Operating with an AI-first mindset, this position provides dedicated, hands-on-keyboard coverage from Thursday through Sunday, closing the weekend dwell-time gap and independently owning High and Critical security incidents end to end. As the sole hands-on DFIR responder during weekend shifts, you will command incidents, execute machine-speed containment, conduct deep-dive memory and cloud forensics, drive root-cause remediation, and author regulatory breach-determination recommendations. While carrying no direct reports, this terminal individual contributor role holds technical authority across the enterprise, setting detection and hunting methodologies, mentoring the broader security operations team, and briefing executive leadership. Schedule: Thursday to Sunday; 9am to 5pm EST in Boca Raton, FL Key Responsibilities 1. Incident Command, Digital Forensics & Malware Analysis (25%) Direct end-to-end incident containment, host isolation, and post-incident root-cause analysis during High and Critical security events as Incident Commander. Serve as the sole weekend hands-on responder, independently owning incidents from initial detection through forensic reconstruction and post-mortem delivery. Execute real-time host isolation via CrowdStrike Real Time Response (RTR) and extract forensic artifacts across volatile memory, storage volumes (EBS, EFS, FSx, S3), container workloads (AWS EKS, ECS, Fargate), and application logs (Apache Tomcat, CI/CD, Databricks). Utilize forensic suites—including CrowdStrike Falcon Forensics, KAPE, Volatility, FTK Imager, and Velociraptor—to perform memory analysis and disk triage. Perform malware triage, dynamic/static reverse engineering, sandbox detonation, deobfuscation, and C2 extraction, translating findings into defensive YARA signatures. Enforce strict evidentiary chain-of-custody protocols and author legally defensible forensic investigation reports adhering to regulatory standards. 2. AI-First Automation, Detection Engineering & Log Architecture (20%) Author, tune, and operationalize multi-source correlation rules and custom Falcon Indicators of Attack (IOAs) using detection-as-code methodologies with version control and CI/CD testing. Write complex query logic across CrowdStrike Query Language (CQL), Falcon Query Language (FQL), Kusto Query Language (KQL), and SQL/Athena against AWS Security Lake (OCSF/Parquet format). Ingest, transform, and optimize high-volume security telemetry using Cribl Stream and Axonius (CAASM) pipelines. Build and maintain automated orchestration workflows using Tines SOAR, CrowdStrike Fusion SOAR, serverless Python tools, and multi-agent AI investigation platforms (custom agents, prompts, and skills) to accelerate analyst triage. Map detection coverage systematically against MITRE ATT&CK and MITRE D3FEND frameworks to run gap analyses and harden defenses. 3. Cyber Threat Intelligence (CTI), Hunting & Threat Surface Defense (20%) Execute the complete intelligence lifecycle against Priority Intelligence Requirements (PIRs)—collection, processing, analysis, dissemination, and feedback—using structured analytic techniques (Diamond Model, Cyber Kill Chain, Analysis of Competing Hypotheses). Design and conduct hypothesis-driven, TTP-based threat hunts evaluated against the Hunting Maturity Model to uncover advanced adversary presence and living-off-the-land techniques. Direct Digital Risk Protection (DRP): monitor underground forums, track unauthorized code commits and secret leaks in external repositories, and manage domain takedowns. Deploy and monitor Thinkst Canary honeytokens and deception assets to detect early-stage reconnaissance and lateral movement. Leverage AI/LLM-driven processing to convert OSINT, dark-web data, Health-ISAC feeds (STIX/TAXII), and CISA Known Exploited Vulnerabilities (KEV) into immediate blocklists and behavioral detection rules. 4. Cloud, Workload, Identity & SaaS Security Operations (20%) Monitor, triage, and investigate threats across a multi-region enterprise AWS footprint of 120+ accounts utilizing AWS Security Lake, CloudTrail, GuardDuty, Detective, Inspector 2, Security Hub, Config, and VPC Flow Logs. Investigate complex identity attacks, Adversary-in-the-Middle (AiTM) techniques, and MFA bypass attempts across Okta, Active Directory, Duo, and Google Workspace. Secure containerized workloads (EKS, ECS, Fargate) and core deployment pipelines (Jenkins, Octopus Deploy, Ansible, GitHub Actions). Operationalize the complete CrowdStrike Falcon platform, including NG-SIEM/LogScale, Spotlight, Discover, EASM, Identity Protection, Falcon Shield, ASPM, CSPM, FileVantage (FIM for PCI compliance), AIDR, and Data Protection/DLP. Defend email channels and investigate phishing and malware outbreaks using Abnormal AI. 5. Regulatory Breach Determination & Legal/Privacy Interface (15%) Own the technical breach/no-breach determination recommendation and assemble the supporting technical evidentiary package. Lead HIPAA four-factor breach risk assessments and coordinate PCI Forensic Investigation (PFI) engagements. Prepare and maintain litigation-hold evidence to forensic legal standards. Interface directly with Legal, the Privacy Officer, outside counsel, cyber-insurance carriers, and the CISO to deliver technical findings that guide statutory notification decisions (OCR, state Attorneys General, contractual SLAs). 6. Program Leadership, Metrics & Continuous Improvement Define, track, and optimize operational metrics: Mean Time to Detect (MTTD), Mean Time to Acknowledge (MTTA), Mean Time to Respond (MTTR), containment time, and adversary dwell time. Translate post-incident lessons learned directly into detection engineering and infrastructure hardening loops. Manage Managed Detection and Response (MDR) vendor performance (ReliaQuest) and direct proof-of-concept evaluations for emerging security technologies. Facilitate purple-team exercises, tabletop simulations, and adversary-emulation tests to validate detection fidelity. Mentor and upskill SOC analysts on AI-assisted investigations and modern digital forensics to eliminate single-person dependencies across the team. Qualifications Minimum Requirements Education & Experience: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or a related technical discipline (or equivalent practical experience). Military & Veteran Substitution: Equivalent military experience in cyber operations, network defense, or signals intelligence (e.g., Army 17C/25D, Navy CTN, Air Force 1B4X1/1D7X1, USMC 17XX, or equivalent Space Force/Coast Guard cyber specializations across Active, Guard, or Reserve) fully substitutes for the degree requirement. 10+ years of progressive, hands-on experience in Digital Forensics, Incident Response (DFIR), SOC operations, and Cyber Threat Intelligence. 3+ years acting in a Principal, Lead, or Staff capacity overseeing complex enterprise breach responses and crisis command. Incident Command & Forensics: Proven record commanding High/Critical enterprise incidents; hands-on expertise with host isolation (CrowdStrike RTR), memory analysis, storage volume forensics (EBS, EFS, FSx, S3), and container investigations under HIPAA, PCI DSS, SOC 2, or HITRUST standards. Cloud & Identity Mastery: Deep experience analyzing telemetry across large AWS organizations (100+ accounts), containerized environments (EKS), CI/CD pipelines, and enterprise identity architectures (Okta, Active Directory, Duo). Automation & Engineering: Proficient in engineering detection logic and queries in CQL, FQL, KQL, and SQL (Athena/OCSF), with scripting/automation capability in Python, PowerShell, or Bash. Threat Surface Defense: Proven experience designing hypothesis-driven threat hunts, directing Digital Risk Protection (secret leak tracking, domain takedowns), deploying deception networks (Thinkst Canary), and operationalizing CTI (Health-ISAC, CISA KEV). Schedule Requirement: Ability and willingness to work a dedicated weekend schedule (Thursday through Sunday) as the primary DFIR responder. Preferred Qualifications Master’s degree in Cybersecurity, Computer Science, or related technical field. Industry certifications: Core DFIR: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH). Cloud & Governance: AWS Certified Security - Specialty, GIAC Cloud Security Automation (GCSA), CCSP, CISSP. AI & Automation: GIAC AI Security Automation Engineer (GASAE), GIAC Machine Learning Engineer (GMLE). CrowdStrike: CrowdStrike Certified Falcon Hunter (CCFH), Falcon Responder (CCFR), or Falcon Administrator (CCFA). Experience administering Tines SOAR, CrowdStrike Fusion SOAR, Cribl Stream, or building agentic LLM investigation workflows. Direct experience handling regulatory breach risk evaluations (HIPAA 4-factor assessments, PFI investigations) in a healthcare technology or SaaS environment. ModMed Benefits Highlight: At ModMed, we believe it’s important to offer a competitive benefits package designed to meet the diverse needs of our growing workforce. Eligible Modernizers can enroll in a wide range of benefits: United States Comprehensive medical, dental, and vision benefits, including a company Health Savings Account contribution, 401(k): ModMed provides a matching contribution each payday of 50% of your contribution deferred on up to 6% of your compensation. After one year of employment with ModMed, 100% of any matching contribution you receive is yours to keep. Generous Paid Time Off and Paid Parental Leave programs, Company paid Life and Disability benefits, Flexible Spending Account, and Employee Assistance Programs, Company-sponsored Business Resource & Special Interest Groups that provide engaged and supportive communities within ModMed, Professional development opportunities, including tuition reimbursement programs and unlimited access to LinkedIn Learning , Global presence and in-person collaboration opportunities; dog-friendly HQ (US), Hybrid office-based roles and remote availability for some roles, Weekly catered breakfast and lunch, treadmill workstations, Zen, and wellness rooms within our BRIC headquarters. PHISHING SCAM WARNING: ModMed is among several companies recently made aware of a phishing scam involving imposters posing as hiring managers recruiting via email, text and social media. The imposters are creating misleading email accounts, conducting remote "interviews," and making fake job offers in order to collect personal and financial information from unsuspecting individuals. Please be aware that no job offers will be made from ModMed without a formal interview process, and valid communications from our hiring team will come from our employees with a ModMed email address (). Please check senders’ email addresses carefully. Additionally, ModMed will not ask you to purchase equipment or supplies as part of your onboarding process. If you are receiving communications as described above, please report them to the FTC website .