Principal DFIR & Threat Intelligence Analyst

Join the Team Modernizing Medicine At Mod Med, we’re not just building software—we’re reimagining the healthcare experience. Founded in 2010 by a practicing physician and a successful tech entrepreneur, we took a radically different approach: we hired doctors and taught them how to code. This "for doctors, by doctors" philosophy has allowed us to create an AI-enabled, specialty-specific cloud platform that places patients at the center of care.

A Culture of Excellence When you join Mod Med, you’re joining an award-winning team recognized for innovation and employee satisfaction.
From our global headquarters in Boca Raton Florida, and extensive employee base in Hyderabad India, we are a team of 4,500+ passionate problem-solvers on a mission to increase medical practice success and improve patient outcomes:
Consistently ranked as a Top Place to Work 2025 Globee Business Awards:
Gold Globee for “Technology Team of the Year” 2025 Black Book Awards:
Ranked #1 EHR in 11 Specialties Florida Venture Forum:
Venture-Backed Company of the Year We are growing fast, thinking big, and we are just getting started.

Ready to modernize medicine with us?

Job Description

Summary:

The Principal, DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function that unifies Cyber Threat Intelligence (CTI), AI-augmented SOC monitoring, Incident Response (IR), Digital Forensics, and Malware Analysis into a single operational pipeline. Operating with an AI-first mindset, this position provides dedicated, hands-on-keyboard coverage from Thursday through Sunday, closing the weekend dwell-time gap and independently owning High and Critical security incidents end to end.

As the sole hands-on DFIR responder during weekend shifts, you will command incidents, execute machine-speed containment, conduct deep-dive memory and cloud forensics, drive root-cause remediation, and author regulatory breach-determination recommendations. While carrying no direct reports, this terminal individual contributor role holds technical authority across the enterprise, setting detection and hunting methodologies, mentoring the broader security operations team, and briefing executive leadership.

Schedule:

Thursday to Sunday; 9am to 5pm EST in Boca Raton, FL

Key Responsibilities
1. Incident Command, Digital Forensics & Malware Analysis (25%)Direct end-to-end incident containment, host isolation, and post-incident root-cause analysis during High and Critical security events as Incident Commander.

Serve as the sole weekend hands-on responder, independently owning incidents from initial detection through forensic reconstruction and post-mortem delivery.

Execute real-time host isolation via Crowd Strike Real Time Response (RTR) and extract forensic artifacts across volatile memory, storage volumes (EBS, EFS, FSx, S3), container workloads (AWS EKS, ECS, Fargate), and application logs (Apache Tomcat, CI/CD, Databricks).Utilize forensic suites—including Crowd Strike Falcon Forensics, KAPE, Volatility, FTK Imager, and Velociraptor—to perform memory analysis and disk triage.

Perform malware triage, dynamic/static reverse engineering, sandbox detonation, deobfuscation, and C2 extraction, translating findings into defensive YARA signatures.

Enforce strict evidentiary chain-of-custody protocols and author legally defensible forensic investigation reports adhering to regulatory standards.
2. AI-First Automation, Detection Engineering & Log Architecture (20%)Author, tune, and operationalize multi-source correlation rules and custom Falcon Indicators of Attack (IOAs) using detection-as-code methodologies with version control and CI/CD testing.

Write complex query logic across Crowd Strike…