Description

Lead cybersecurity incident investigations for clinical systems, EHRs, and medical devices, managing containment and recovery across enterprise environments.

This role is remote.

Responsibilities

• Respond to escalated alerts from the Security Operations Center (SOC) and coordinate containment efforts.
• Perform incident triage, root cause analysis, and recovery across on-premises and cloud infrastructure.
• Analyze security alerts, logs, endpoint telemetry, and network traffic to identify threats.
• Develop and refine incident response playbooks and detection logic.

Required Skills

• 5+ years of cybersecurity experience with a focus on incident response or threat detection.
• Proficiency with SIEM platforms, specifically Splunk.
• Experience with Endpoint Detection and Response (EDR) tools such as CrowdStrike or SentinelOne.
• Strong investigative skills across Windows and Linux environments.
• Deep understanding of incident response frameworks like NIST 800-61 and threat models like MITRE ATT&CK.
• Experience in large enterprise environments, preferably within healthcare or regulated industries.
• Ability to document incidents clearly and concisely.

Preferred Skills

• Any Graduate degree.

Key Skills

Education

Any Graduate