Senior Incident Response Analyst

Open Loop was co-founded by CEO, Dr. Jon Lensing, and COO, Christian Williams, with the vision to bring care anywhere. Our telehealth support solutions are thoughtfully designed to streamline and simplify go-to-market care delivery for companies offering meaningful virtual support to patients across an expansive array of specialties, in all 50 states.

Open Loop’s mission is to bring care anywhere by powering telehealth solutions  Security Operations team protects the clinical and operational systems that Open Loop and our partners run patient care on. As a Senior Incident Response Analyst, you’ll be a dedicated responder on our DFIR function — owning incidents end to end, deepening our forensic capability, and making sure containment happens fast when PHI and clinical operations are on the line.

• Own tier-1 and tier-2 incidents end to end: detection validation, triage, scoping, containment, eradication, recovery, and post-incident review.

• Run host, memory, network, cloud, and identity forensic investigations independently, with evidence handling that holds up to legal, regulatory, and client scrutiny.

• Investigate from EDR and SIEM telemetry — write and refine queries, build correlation logic, and reconstruct incident timelines from log data.

• Share the IR on-call rotation with the Lead Incident Responder and Senior Staff Security Analyst, and exercise named containment authority (host isolation, session revocation) within a defined threshold.

• Author and rewrite IR playbooks based on incidents you personally work, and run post-incident reviews with findings tracked to closure.

• Automate or AI-assist repetitive triage and evidence-collection steps so the team’s time goes to investigation rather than toil.

• Write for two audiences — a defensible technical timeline and an executive summary of the same incident.

You’re a hands-on responder who has led real incidents under real ambiguity, and you’re straight about what you got wrong. We hire for the discipline, not the tool SKU or the credential: no specific degree is required, and strong responders from Defender, Sentinel One, Splunk, or Sentinel environments are fully in scope. This is an individual contributor role.

• 6–8 years of hands-on security experience, with the majority in incident response and/or digital forensics.

• Demonstrated ownership of the full incident lifecycle, from detection validation through post-incident review.

• Digital forensics breadth across host/disk, memory, network, cloud, and identity — from real casework, not coursework.

• Working depth in EDR/EPP: investigating from endpoint telemetry, running response actions, and tuning what the tool surfaces.

• Working depth in SIEM: query authoring, correlation logic, and timeline reconstruction from log data.

• Hands-on fluency with a forensic toolchain (e.g., Velociraptor, KAPE, Volatility, Autopsy/EnCase/FTK/X-Ways, plaso, Zeek, Wireshark).

• Evidence handling discipline — chain of custody, sound acquisition, and documentation that survives legal, regulatory, and client scrutiny.

• MITRE ATT&CK fluency applied to real investigations.

• Scripting for investigation and automation (Python, Power Shell, or similar).

• Demonstrated, hands-on use of AI tools (Claude, ChatGPT, Copilot, or equivalent) in security work, with specific examples of their impact on speed or quality — and sound judgment about AI and sensitive data (PHI, credentials, telemetry).

• Clear incident writing: able to produce both a technical timeline and an executive summary of the same incident.

• Willingness to participate in a shared IR on-call rotation.

• Crowd Strike Falcon EDR — hands-on investigation and response in the console.

• Crowd Strike…