Incident Response Analyst

The Incident Response Analyst is responsible for first-line monitoring, triage, detection, and escalation of security alerts and reported phishing activity across the organization’s information systems. The role works under general direction, exercising independent judgment on day-to-day disposition and containment decisions, and collaborates closely with Information Security staff, IT Operations, and Compliance stakeholders to protect sensitive Medicare Advantage member data under HIPAA and HITRUST regulatory frameworks. By owning high-volume alert triage, limited containment actions, and structured incident documentation, this position directly reduces risk exposure and supports audit readiness, while building a clear, reviewable record of progression toward threat hunting and broader detection engineering over time.

Job Duties / Responsibilities

• Triage and Investigate Security Alerts. Monitor and disposition alerts from the endpoint detection and response (EDR) platform, applying judgment to determine which investigative path to follow and how deeply to investigate within documented escalation criteria, and recording the specific process, file, or network activity reviewed and the reasoning behind each disposition, not only the outcome.

• Respond to and Contain Confirmed Threats. Independently assess evidence of compromise and, when warranted, restrict or disable a host or account without waiting for approval, then promptly notify senior Information Security staff of the action taken and the rationale.

• Investigate and Triage Phishing Reports. Independently determine whether a reported or suspicious email is malicious or benign, using the organization’s email security platform to validate sender reputation, headers, and links, and take appropriate action, recognizing that an incorrect disposition carries real consequences for member data and organizational integrity.

• Query and Correlate Logs in the SIEM. Independently query and correlate logs in the organization’s SIEM or log-analytics platform to support alert triage, incident investigation, and ad hoc security requests from Information Security leadership.

• Apply Threat Intelligence to Detection and Blocking. Monitor threat-intelligence feeds and healthcare sector ISACs for indicators of compromise, and add confirmed malicious indicators to blocklists directly; propose broader architectural tuning changes to senior staff for review. This foundation is expected to grow into independently proposing and implementing more complex, cross-system tuning and control changes over time, documented to provide a clear, reviewable record of progression.

• Tune Detection Rules and Suppress False Positives. Implement narrowly scoped tuning changes to the EDR and SIEM (e.g., suppressing a confirmed false positive or adjusting a basic detection rule for a confirmed pattern), documenting each change and building, with increasing independence over time, toward structured, hypothesis-driven threat hunting during low-volume periods, providing a clear, reviewable record of progression along this path.

• Document Incidents and Escalate with Clarity. Document all incidents and investigations using the team’s incident-tracking system and NIST SP 800-61 methodology, providing factual, auditable detail and a reasoned recommendation that senior staff rely on whenever escalating.

• Maintain Compliance Awareness and Regulatory Currency. Stay current on HIPAA, HITRUST, the NIST Cybersecurity Framework, and CIS Controls as they apply to day-to-day triage work, performing all work in an ethical manner consistent with contractual, regulatory, and legal obligations.

• Respond to After-Hours Critical Alerts. Respond to occasional after-hours security alerts that are critical in nature, following defined escalation procedures.

• Triage and Route Incoming Tickets. Perform first-pass normalization, triage, and routing of incoming Information Security tickets, treating every new ticket as a potential availability-impacting issue until triage determines otherwise, and assign each ticket to the appropriate Information Security staff member in a timely manner.

• Participate in Team Operations. Participate in Information Security team stand-ups, tabletop exercises, and periodic peer review of closed tickets.

Required:

• 1-2 years of hands-on experience in an IT, help desk, or security operations role; internship, apprenticeship, or structured lab-based coursework in security operations will also be considered.

• Demonstrated, hands-on ability to investigate a security alert using an EDR platform, including reviewing process behavior and parent/child relationships, sufficient to explain why an event was escalated, closed, or acted upon by temporarily restricting a host or account, not just what the final disposition was.

• Demonstrated ability to independently query and correlate logs in a SIEM or log-analytics platform to support an investigation.

• Demonstrated ability to evaluate evidence of compromise and decide, without waiting for approval, whether to restrict or disable a host or account, weighing the consequence of acting against the consequence of not acting.

• Demonstrated ability to recognize recurring false positives or noisy alert patterns from daily triage work and to implement a narrowly-scoped, reasoned tuning change to address them, as the foundation for growing into independent threat hunting.

• Demonstrated ability to recognize a threat-intelligence item relevant to the organization’s environment, explain why it matters, and add a confirmed indicator to the appropriate blocklist or filtering policy, as the foundation for growing into proposing broader tuning or control changes.

• Ability to apply AI-assisted tools effectively in a professional setting, with a clear understanding of their limitations and the discipline to validate AI-generated output before relying on it, extending this same discipline to incident response work.

• Ability to demonstrate proficiency in alert triage, narrowly-scoped tuning, containment decision-making, and foundational threat hunting and threat-intelligence application through practical application, not solely through prior credentials or self-reported experience.

Preferred:

• Prior experience in healthcare, health insurance, or another regulated industry (HIPAA, HITECH, HITRUST).

Education

Required:

• Associate degree in Computer Science, Information Security, or a related technical discipline, and/or equivalent demonstrated work experience.

Preferred:

• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or a related discipline.

Training

Required:

• Familiarity with NIST SP 800-61 (Computer Security Incident Handling Guide) as the baseline methodology for incident documentation and lifecycle management.

• Understanding of HIPAA Security Rule requirements as they apply to the protection of electronic Protected Health Information (ePHI).

Preferred:

• Completion of SANS/GIAC coursework, CompTIA cybersecurity training, or equivalent self-study with demonstrated lab application.

Skills & Competencies

Technical / Role-Specific Skills

• Cyber Incident Response: Proficiency in the policies, practices, and procedures to detect, investigate, and respond to cyber attacks or unauthorized access to sensitive data systems, including minimizing impact and preventing future incidents.

• SIEM / Log Analytics: Ability to independently query and correlate logs from platforms such as Splunk, Microsoft Sentinel, Rapid7 InsightIDR, or Elastic Security to support investigations and ad hoc security requests.

• EDR Platform Operations: Hands-on experience with endpoint detection and response platforms such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint, including process behavior analysis and containment actions.

• Vulnerability Assessment and Management: Ability to assess and triage emerging vulnerabilities (CVEs) and apply indicators of compromise to blocklists and filtering policies, with familiarity in tools such as Rapid7 InsightVM, Tenable, or Qualys.

• Threat Management and Intelligence Consumption: Ability to monitor threat-intel feeds and sector ISACs, translate indicators into actionable detection logic, and document findings and actions taken for audit and process-improvement purposes.

Professional & Behavioral Competencies

• Analytical Judgment: Proven ability to think analytically, exercise sound judgment under time pressure, and ask clarifying questions rather than closing an item prematurely.

• Documentation Discipline: Discipline to document the reasoning behind every disposition, not only the outcome, producing records that another analyst or auditor can follow.

• Professional Integrity: Moral character with virtues such as integrity, fortitude, honesty, and dedication.

• Communication: Excellent oral and written communication skills, including the ability to clearly communicate technical details to non-technical users.

Alignment Health is breaking the mold in conventional health care, committed to serving seniors and those who need it most: the chronically ill and frail. It takes an entire team of passionate and caring people, united in our mission to put the senior first. We have built a team of talented and experienced people who are passionate about transforming the lives of the seniors we serve. In this fast-growing company, you will find ample room for growth and innovation alongside the Alignment Health community. Working at Alignment Health provides an opportunity to do work that really matters, not only changing lives but saving them. Together.