{"id":655532,"url":"https://alion.io/job/openloophealth-senior-incident-response-analyst","title":"Senior Incident Response Analyst","company":{"id":678301,"name":"OpenLoop Health","domain":"openloophealth.com","url":"https://alion.io/company/openloophealth","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":89,"open_postings":11,"ghost_share":0,"stale_share":0.455,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":117000,"max_usd":211000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":390},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Autopsy","optional":false},{"name":"ChatGPT","optional":false},{"name":"Claude","optional":false},{"name":"Copilot","optional":false},{"name":"EnCase","optional":false},{"name":"FTK","optional":false},{"name":"KAPE","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Velociraptor","optional":false},{"name":"Volatility","optional":false},{"name":"Wireshark","optional":false},{"name":"X-Ways Forensics","optional":false},{"name":"Zeek","optional":false},{"name":"AWS","optional":true},{"name":"Crowdstrike","optional":true},{"name":"Falcon","optional":true},{"name":"HIPAA","optional":true},{"name":"IAM","optional":true},{"name":"LLM","optional":true},{"name":"Okta","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-09-08T13:43:03Z","employer_posted_date":"2026-09-08","last_verified_at":"2026-10-28T23:55:39Z","board_verified":true,"closed_at":null,"days_open":50,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":50},"description":"About OpenLoop\nOpenLoop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states.\nAbout the Role\nOpenLoop’s mission is to bring care anywhere by powering telehealth solutions at scale. Our Security Operations team protects the clinical and operational systems that OpenLoop and our partners run patient care on. As a Senior Incident Response Analyst, you’ll be a dedicated responder on our DFIR function - owning incidents end to end, deepening our forensic capability, and making sure containment happens fast when PHI and clinical operations are on the line.\nWhat You’ll Do\nOwn tier-1 and tier-2 incidents end to end: detection validation, triage, scoping, containment, eradication, recovery, and post-incident review.\n\nRun host, memory, network, cloud, and identity forensic investigations independently, with evidence handling that holds up to legal, regulatory, and client scrutiny.\n\nInvestigate from EDR and SIEM telemetry - write and refine queries, build correlation logic, and reconstruct incident timelines from log data.\n\nShare the IR on-call rotation with the Lead Incident Responder and Senior Staff Security Analyst, and exercise named containment authority (host isolation, session revocation) within a defined threshold.\n\nAuthor and rewrite IR playbooks based on incidents you personally work, and run post-incident reviews with findings tracked to closure.\n\nAutomate or AI-assist repetitive triage and evidence-collection steps so the team’s time goes to investigation rather than toil.\n\nWrite for two audiences - a defensible technical timeline and an executive summary of the same incident.\n\nWho You Are\nYou’re a hands-on responder who has led real incidents under real ambiguity, and you’re straight about what you got wrong. We hire for the discipline, not the tool SKU or the credential: no specific degree is required, and strong responders from Defender, SentinelOne, Splunk, or Sentinel environments are fully in scope. This is an individual contributor role.\nRequired Qualifications\n6-8 years of hands-on security experience, with the majority in incident response and/or digital forensics.\n\nDemonstrated ownership of the full incident lifecycle, from detection validation through post-incident review.\n\nDigital forensics breadth across host/disk, memory, network, cloud, and identity - from real casework, not coursework.\n\nWorking depth in EDR/EPP: investigating from endpoint telemetry, running response actions, and tuning what the tool surfaces.\n\nWorking depth in SIEM: query authoring, correlation logic, and timeline reconstruction from log data.\n\nHands-on fluency with a forensic toolchain (e.g., Velociraptor, KAPE, Volatility, Autopsy/EnCase/FTK/X-Ways, plaso, Zeek, Wireshark).\n\nEvidence handling discipline - chain of custody, sound acquisition, and documentation that survives legal, regulatory, and client scrutiny.\n\nMITRE ATT&CK fluency applied to real investigations.\n\nScripting for investigation and automation (Python, PowerShell, or similar).\n\nDemonstrated, hands-on use of AI tools (Claude, ChatGPT, Copilot, or equivalent) in security work, with specific examples of their impact on speed or quality - and sound judgment about AI and sensitive data (PHI, credentials, telemetry).\n\nClear incident writing: able to produce both a technical timeline and an executive summary of the same incident.\n\nWillingness to participate in a shared IR on-call rotation.\n\nPreferred Qualifications\nCrowdStrike Falcon EDR - hands-on investigation and response in the console.\n\nCrowdStrike Falcon Next-Gen SIEM - CQL query authoring, correlation rules, and dashboards.\n\nCrowdStrike Falcon Shield - SaaS app, identity, and third-party integration risk.\n\nCloud incident response in AWS (CloudTrail, GuardDuty, IAM abuse patterns).\n\nIdentity-centric investigation, particularly Okta (session hijacking, MFA fatigue, token theft, SSO abuse).\n\nHealthcare, fintech, or other regulated-industry experience with sensitive data.\n\nHIPAA, HITRUST, or SOC 2 from the operator side, including breach determination workflow.\n\nGCFA, GCFE, GCIH, GNFA, GCIA, GREM, or equivalent demonstrated expertise.\n\nMalware triage and reverse engineering fundamentals.\n\nSOAR / automation platform experience, or AI-assisted IR workflows built on LLM APIs.\n\nMulti-entity or M&A environment experience - we operate across several subsidiaries.\n\nOpen-source contributions to DFIR or security tooling; CTF history, conference talks, or other community engagement.\n\nExperience maturing an IR program from a lower baseline.\n\nThreat intelligence consumption applied to active investigations.\n\nWhat Success Looks Like\nIn your first 6 months: fully onboarded and taking primary responder duty on a defined rotation, independently owning tier-1 and tier-2 incidents without escalation for routine cases.\n\nForensic capability is genuinely two-deep - you can run a host, memory, cloud, or identity investigation without the Lead Incident Responder in the room.\n\nAt least three IR playbooks rewritten or newly authored from incidents you worked, with post-incident reviews running on a consistent cadence and findings tracked to closure.\n\nIn your first 12 months: measurable reduction in MTTD and MTTR against baseline, with repetitive triage and evidence collection automated or AI-assisted rather than manual.\n\nOur Benefits\nIn addition, for salaried positions you would also be eligible for:\nMedical, Dental, and Vision plans\n\nFlexible Spending/Health Savings Accounts\n\nFlexible PTO\n\n401(k) + Company Match\n\nLife Insurance, Pet insurance, and more\n\nOur Company\nWe have a relatively flat organizational structure here at OpenLoop. Everyone is encouraged to bring ideas to the table and make things happen. This fits in well with our core values of Autonomy, Competence and Belonging, as we want everyone to feel empowered and supported to do their best work.\nSound like a good fit? We’d love to meet you.","description_format":"text","description_chars":6176,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Telemedicine & Virtual Care","Pharmacies"],"lifecycle":[{"event":"open","at":"2026-09-10T20:52:58Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2","filings_12m":2,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":172500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":48,"band":"ok","label":"Likely open","p_open":1,"p_active":0.875,"p_room":0.55,"age_days":49,"expected_fill_days":34,"reasons":["conf:4","velocity","win:tail"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/openloophealth-senior-incident-response-analyst","json_url":"https://alion.io/job/openloophealth-senior-incident-response-analyst.json","meta":{"generated_at":"2026-10-29T03:21:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5114,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678301},"rest":"https://alion.io/mcp/rest/get_company?id=678301"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fopenloophealth-senior-incident-response-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fopenloophealth-senior-incident-response-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fopenloophealth-senior-incident-response-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/openloophealth-senior-incident-response-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fopenloophealth-senior-incident-response-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":655532}},{"tool":"search_jobs","arguments":{"company":"openloophealth.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":655532},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}