Principal DFIR & Threat Intelligence Analyst

Join the Team Modernizing Medicine

AtModMed were not just building softwarewere reimagining the healthcare experience. Founded in 2010 by a practicing physician and a successful tech entrepreneur we took a radically different approach:we hired doctors and taught them how to code.This for doctors by doctors philosophy has allowed us to create an AI-enabled specialty-specific cloud platform that places patients at the center of care.

A Culture of Excellence

When you join ModMed youre joining an award-winning team recognized for innovation and employee satisfaction. From our global headquarters in Boca Raton Florida and extensive employee base in Hyderabad India we are a team of 4500 passionate problem-solvers on a mission to increase medical practice success and improve patient outcomes:

• Consistently ranked as a Top Place to Work

• 2025 Globee Business Awards:Gold Globee for Technology Team of the Year

• 2025 Black Book Awards:Ranked #1 EHR in 11 Specialties

• Florida Venture Forum:Venture-Backed Company of the Year

We are growing fast thinking big and we are just getting started.

Ready to modernize medicine with us

Job Description Summary:

The Principal DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function that unifies Cyber Threat Intelligence (CTI) AI-augmented SOC monitoring Incident Response (IR) Digital Forensics and Malware Analysis into a single operational pipeline. Operating with an AI-first mindset this position provides dedicated hands-on-keyboard coverage from Thursday through Sunday closing the weekend dwell-time gap and independently owning High and Critical security incidents end to end.

As the sole hands-on DFIR responder during weekend shifts you will command incidents execute machine-speed containment conduct deep-dive memory and cloud forensics drive root-cause remediation and author regulatory breach-determination recommendations. While carrying no direct reports this terminal individual contributor role holds technical authority across the enterprise setting detection and hunting methodologies mentoring the broader security operations team and briefing executive leadership.

Schedule: Thursday to Sunday; 9am to 5pm EST in Boca Raton FL

1. Incident Command Digital Forensics & Malware Analysis (25%)

• Direct end-to-end incident containment host isolation and post-incident root-cause analysis during High and Critical security events as Incident Commander.
• Serve as the sole weekend hands-on responder independently owning incidents from initial detection through forensic reconstruction and post-mortem delivery.
• Execute real-time host isolation via CrowdStrike Real Time Response (RTR) and extract forensic artifacts across volatile memory storage volumes (EBS EFS FSx S3) container workloads (AWS EKS ECS Fargate) and application logs (Apache Tomcat CI/CD Databricks).
• Utilize forensic suitesincluding CrowdStrike Falcon Forensics KAPE Volatility FTK Imager and Velociraptorto perform memory analysis and disk triage.
• Perform malware triage dynamic/static reverse engineering sandbox detonation deobfuscation and C2 extraction translating findings into defensive YARA signatures.
• Enforce strict evidentiary chain-of-custody protocols and author legally defensible forensic investigation reports adhering to regulatory standards.

2. AI-First Automation Detection Engineering & Log Architecture (20%)

• Author tune and operationalize multi-source correlation rules and custom Falcon Indicators of Attack (IOAs) using detection-as-code methodologies with version control and CI/CD testing.
• Write complex query logic across CrowdStrike Query Language (CQL) Falcon Query Language (FQL) Kusto Query Language (KQL) and SQL/Athena against AWS Security Lake (OCSF/Parquet format).
• Ingest transform and optimize high-volume security telemetry using Cribl Stream and Axonius (CAASM) pipelines.
• Build and maintain automated orchestration workflows using Tines SOAR CrowdStrike Fusion SOAR serverless Python tools and multi-agent AI investigation platforms (custom agents prompts and skills) to accelerate analyst triage.
• Map detection coverage systematically against MITRE ATT&CK and MITRE D3FEND frameworks to run gap analyses and harden defenses.

3. Cyber Threat Intelligence (CTI) Hunting & Threat Surface Defense (20%)

• Execute the complete intelligence lifecycle against Priority Intelligence Requirements (PIRs)collection processing analysis dissemination and feedbackusing structured analytic techniques (Diamond Model Cyber Kill Chain Analysis of Competing Hypotheses).
• Design and conduct hypothesis-driven TTP-based threat hunts evaluated against the Hunting Maturity Model to uncover advanced adversary presence and living-off-the-land techniques.
• Direct Digital Risk Protection (DRP): monitor underground forums track unauthorized code commits and secret leaks in external repositories and manage domain takedowns.
• Deploy and monitor Thinkst Canary honeytokens and deception assets to detect early-stage reconnaissance and lateral movement.
• Leverage AI/LLM-driven processing to convert OSINT dark-web data Health-ISAC feeds (STIX/TAXII) and CISA Known Exploited Vulnerabilities (KEV) into immediate blocklists and behavioral detection rules.

4. Cloud Workload Identity & SaaS Security Operations (20%)

• Monitor triage and investigate threats across a multi-region enterprise AWS footprint of 120 accounts utilizing AWS Security Lake CloudTrail GuardDuty Detective Inspector 2 Security Hub Config and VPC Flow Logs.
• Investigate complex identity attacks Adversary-in-the-Middle (AiTM) techniques and MFA bypass attempts across Okta Active Directory Duo and Google Workspace.
• Secure containerized workloads (EKS ECS Fargate) and core deployment pipelines (Jenkins Octopus Deploy Ansible GitHub Actions).
• Operationalize the complete CrowdStrike Falcon platform including NG-SIEM/LogScale Spotlight Discover EASM Identity Protection Falcon Shield ASPM CSPM FileVantage (FIM for PCI compliance) AIDR and Data Protection/DLP.
• Defend email channels and investigate phishing and malware outbreaks using Abnormal AI.

5. Regulatory Breach Determination & Legal/Privacy Interface (15%)

• Own the technical breach/no-breach determination recommendation and assemble the supporting technical evidentiary package.
• Lead HIPAA four-factor breach risk assessments and coordinate PCI Forensic Investigation (PFI) engagements.
• Prepare and maintain litigation-hold evidence to forensic legal standards.
• Interface directly with Legal the Privacy Officer outside counsel cyber-insurance carriers and the CISO to deliver technical findings that guide statutory notification decisions (OCR state Attorneys General contractual SLAs).

6. Program Leadership Metrics & Continuous Improvement

• Define track and optimize operational metrics: Mean Time to Detect (MTTD) Mean Time to Acknowledge (MTTA) Mean Time to Respond (MTTR) containment time and adversary dwell time.
• Translate post-incident lessons learned directly into detection engineering and infrastructure hardening loops.
• Manage Managed Detection and Response (MDR) vendor performance (ReliaQuest) and direct proof-of-concept evaluations for emerging security technologies.
• Facilitate purple-team exercises tabletop simulations and adversary-emulation tests to validate detection fidelity.
• Mentor and upskill SOC analysts on AI-assisted investigations and modern digital forensics to eliminate single-person dependencies across the team.

Minimum Requirements

• Education & Experience:
  • Bachelors degree in Cybersecurity Computer Science Information Technology Statistics Mathematics or a related technical discipline (or equivalent practical experience).
  • Military & Veteran Substitution: Equivalent military experience in cyber operations network defense or signals intelligence (e.g. Army 17C/25D Navy CTN Air Force 1B4X1/1D7X1 USMC 17XX or equivalent Space Force/Coast Guard cyber specializations across Active Guard or Reserve) fully substitutes for the degree requirement.
  • 10 years of progressive hands-on experience in Digital Forensics Incident Response (DFIR) SOC operations and Cyber Threat Intelligence.
  • 3 years acting in a Principal Lead or Staff capacity overseeing complex enterprise breach responses and crisis command.
• Incident Command & Forensics: Proven record commanding High/Critical enterprise incidents; hands-on expertise with host isolation (CrowdStrike RTR) memory analysis storage volume forensics (EBS EFS FSx S3) and container investigations under HIPAA PCI DSS SOC 2 or HITRUST standards.
• Cloud & Identity Mastery: Deep experience analyzing telemetry across large AWS organizations (100 accounts) containerized environments (EKS) CI/CD pipelines and enterprise identity architectures (Okta Active Directory Duo).
• Automation & Engineering: Proficient in engineering detection logic and queries in CQL FQL KQL and SQL (Athena/OCSF) with scripting/automation capability in Python PowerShell or Bash.
• Threat Surface Defense: Proven experience designing hypothesis-driven threat hunts directing Digital Risk Protection (secret leak tracking domain takedowns) deploying deception networks (Thinkst Canary) and operationalizing CTI (Health-ISAC CISA KEV).
• Schedule Requirement: Ability and willingness to work a dedicated weekend schedule (Thursday through Sunday) as the primary DFIR responder.

• Masters degree in Cybersecurity Computer Science or related technical field.
• Industry certifications:
  • Core DFIR: GIAC Certified Forensic Analyst (GCFA) GIAC Certified Incident Handler (GCIH).
  • Cloud & Governance: AWS Certified Security - Specialty GIAC Cloud Security Automation (GCSA) CCSP CISSP.
  • AI & Automation: GIAC AI Security Automation Engineer (GASAE) GIAC Machine Learning Engineer (GMLE).
  • CrowdStrike: CrowdStrike Certified Falcon Hunter (CCFH) Falcon Responder (CCFR) or Falcon Administrator (CCFA).
• Experience administering Tines SOAR CrowdStrike Fusion SOAR Cribl Stream or building agentic LLM investigation workflows.
• Direct experience handling regulatory breach risk evaluations (HIPAA 4-factor assessments PFI investigations) in a healthcare technology or SaaS environment.

ModMed Benefits Highlight: At ModMed we believe its important to offer a competitive benefits package designed to meet the diverse needs of our growing workforce. Eligible Modernizers can enroll in a wide range of benefits:

United States

• Comprehensive medical dental and vision benefits including a company Health Savings Account contribution
• 401(k): ModMed provides a matching contribution each payday of 50% of your contribution deferred on up to 6% of your compensation. After one year of employment with ModMed 100% of any matching contribution you receive is yours to keep.
• Generous Paid Time Off and Paid Parental Leave programs
• Company paid Life and Disability benefits Flexible Spending Account and Employee Assistance Programs
• Company-sponsored Business Resource & Special Interest Groups that provide engaged and supportive communities within ModMed
• Professional development opportunities including tuition reimbursement programs and unlimited access to LinkedIn Learning
• Global presence and in-person collaboration opportunities; dog-friendly HQ (US) Hybrid office-based roles and remote availability for some roles
• Weekly catered breakfast and lunch treadmill workstations Zen and wellness rooms within our BRIC headquarters.

PHISHING SCAM WARNING: ModMed is among several companies recently made aware of a phishing scam involving imposters posing as hiring managers recruiting via email text and social media. The imposters are creating misleading email accounts conducting remote interviews and making fake job offers in order to collect personal and financial information from unsuspecting individuals. Please be aware that no job offers will be made from ModMed without a formal interview process and valid communications from our hiring team will come from our employees with a ModMed email address (). Please check senders email addresses carefully. Additionally ModMed will not ask you to purchase equipment or supplies as part of your onboarding process. If you are receiving communications as described above please report them to the FTC website.