Incident Response Analyst

Alignment Health is breaking the mold in conventional health care, committed to serving seniors and those who need it most: the chronically ill and frail. It takes an entire team of passionate and caring people, united in our mission to put the senior first.We have built a team of talented and experienced people who are passionate about transforming the lives of the seniors we serve. In this fast-growing company, you will find ample room for growth and innovation alongside the Alignment Health community. Working at Alignment Health provides an opportunity to do work that really matters, not only changing lives but saving them. Together.

The Incident Response Analyst is responsible for first-line monitoring, triage, detection, and escalation of security alerts and reported phishing activity across the organization's information systems. The role works under general direction, exercising independent judgment on day-to-day disposition and containment decisions, and collaborates closely with Information Security staff, IT Operations, and Compliance stakeholders to protect sensitive Medicare Advantage member data under HIPAA and HITRUST regulatory frameworks. By owning high-volume alert triage, limited containment actions, and structured incident documentation, this position directly reduces risk exposure and supports audit readiness, while building a clear, reviewable record of progression toward threat hunting and broader detection engineering over time.

Job Duties / Responsibilities 

• Triage and Investigate Security Alerts. Monitor and disposition alerts from the endpoint detection and response (EDR) platform, applying judgment to determine which investigative path to follow and how deeply to investigate within documented escalation criteria, and recording the specific process, file, or network activity reviewed and the reasoning behind each disposition, not only the outcome. 

• Respond to and Contain Confirmed Threats. Independently assess evidence of compromise and, when warranted, restrict or disable a host or account without waiting for approval, then promptly notify senior Information Security staff of the action taken and the rationale. 

• Investigate and Triage Phishing Reports. Independently determine whether a reported or suspicious email is malicious or benign, using the organization's email security platform to validate sender reputation, headers, and links, and take appropriate action, recognizing that an incorrect disposition carries real consequences for member data and organizational integrity. 

• Query and Correlate Logs in the SIEM. Independently query and correlate logs in the organization's SIEM or log-analytics platform to support alert triage, incident investigation, and ad hoc security requests from Information Security leadership. 

• Apply Threat Intelligence to Detection and Blocking. Monitor threat-intelligence feeds and healthcare sector ISACs for indicators of compromise, and add confirmed malicious indicators to blocklists directly; propose broader architectural tuning changes to senior staff for review. This foundation is expected to grow into independently proposing and implementing more complex, cross-system tuning and control changes over time, documented to provide a clear, reviewable record of progression. 

• Tune Detection Rules and Suppress False Positives. Implement narrowly scoped tuning changes to the EDR and SIEM (e.g., suppressing a confirmed false positive or adjusting a basic detection rule for a confirmed pattern), documenting each change and building, with increasing independence over time, toward structured, hypothesis-driven threat hunting during low-volume periods, providing a clear, reviewable record of progression along this path. 

• Document Incidents and Escalate with Clarity. Document all incidents and investigations using the team's incident-tracking system and NIST SP 800-61 methodology, providing factual, auditable detail and a reasoned recommendation that senior staff rely on whenever escalating. 

• Maintain Compliance Awareness and Regulatory Currency. Stay current on HIPAA, HITRUST, the NIST Cybersecurity Framework, and CIS Controls as they apply to day-to-day triage work, performing all work in an ethical manner consistent with contractual, regulatory, and legal obligations. 

• Respond to After-Hours Critical Alerts. Respond to occasional after-hours security alerts that are critical in nature, following defined escalation procedures. 

• Triage and Route Incoming Tickets. Perform first-pass normalization, triage, and routing of incoming Information Security tickets, treating every new ticket as a potential availability-impacting issue until triage determines otherwise, and assign each ticket to the appropriate Information Security staff member in a timely manner. 

• Participate in Team Operations. Participate in Information Security team stand-ups, tabletop exercises, and periodic peer review of closed tickets. 

Supervisory Responsibilities 

This role has no supervisory responsibilities. 

Job Requirements 

Experience 

Required: 

• 1–2 years of hands-on experience in an IT, help desk, or security operations role; internship, apprenticeship, or structured lab-based coursework in security operations will also be considered. 

• Demonstrated, hands-on ability to investigate a security alert using an EDR platform, including reviewing process behavior and parent/child relationships, sufficient to explain why an event was escalated, closed, or acted upon by temporarily restricting a host or account, not just what the final disposition was. 

• Demonstrated ability to independently query and correlate logs in a SIEM or log-analytics platform to support an investigation. 

• Demonstrated ability to evaluate evidence of compromise and decide, without waiting for approval, whether to restrict or disable a host or account, weighing the consequence of acting against the consequence of not acting. 

• Demonstrated ability to recognize recurring false positives or noisy alert patterns from daily triage work and to implement a narrowly-scoped, reasoned tuning change to address them, as the foundation for growing into independent threat hunting. 

• Demonstrated ability to recognize a threat-intelligence item relevant to the organization’s environment, explain why it matters, and add a confirmed indicator to the appropriate blocklist or filtering policy, as the foundation for growing into proposing broader tuning or control changes. 

• Ability to apply AI-assisted tools effectively in a professional setting, with a clear understanding of their limitations and the discipline to validate AI-generated output before relying on it, extending this same discipline to incident response work. 

• Ability to demonstrate proficiency in alert triage, narrowly-scoped tuning, containment decision-making, and foundational threat hunting and threat-intelligence application through practical application, not solely through prior credentials or self-reported experience. 

Preferred: 

• Prior experience in healthcare, health insurance, or another regulated industry (HIPAA, HITECH, HITRUST). 

Education 

Required: 

• Associate degree in Computer Science, Information Security, or a related technical discipline, and/or equivalent demonstrated work experience. 

Preferred: 

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or a related discipline. 

Training 

Required: 

• Familiarity with NIST SP 800-61 (Computer Security Incident Handling Guide) as the baseline methodology for incident documentation and lifecycle management. 

• Understanding of HIPAA Security Rule requirements as they apply to the protection of electronic Protected Health Information (ePHI). 

Preferred: 

• Completion of SANS/GIAC coursework, CompTIA cybersecurity training, or equivalent self-study with demonstrated lab application. 

Skills & Competencies 

Technical / Role-Specific Skills 

• Cyber Incident Response: Proficiency in the policies, practices, and procedures to detect, investigate, and respond to cyber attacks or unauthorized access to sensitive data systems, including minimizing impact and preventing future incidents. 

• SIEM / Log Analytics: Ability to independently query and correlate logs from platforms such as Splunk, Microsoft Sentinel, Rapid7 InsightIDR, or Elastic Security to support investigations and ad hoc security requests. 

• EDR Platform Operations: Hands-on experience with endpoint detection and response platforms such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint, including process behavior analysis and containment actions. 

• Vulnerability Assessment and Management: Ability to assess and triage emerging vulnerabilities (CVEs) and apply indicators of compromise to blocklists and filtering policies, with familiarity in tools such as Rapid7 InsightVM, Tenable, or Qualys. 

• Threat Management and Intelligence Consumption: Ability to monitor threat-intel feeds and sector ISACs, translate indicators into actionable detection logic, and document findings and actions taken for audit and process-improvement purposes. 

Professional & Behavioral Competencies 

• Analytical Judgment: Proven ability to think analytically, exercise sound judgment under time pressure, and ask clarifying questions rather than closing an item prematurely. 

• Documentation Discipline: Discipline to document the reasoning behind every disposition, not only the outcome, producing records that another analyst or auditor can follow. 

• Professional Integrity: Moral character with virtues such as integrity, fortitude, honesty, and dedication. 

• Communication: Excellent oral and written communication skills, including the ability to clearly communicate technical details to non-technical users. 

Work Conditions 

• Remote work from within the Pacific time zone. 

• Occasional availability to respond to after-hours security alerts that are critical in nature. 

• Occasional travel to the organization’s Orange, California headquarters. 

Essential Physical Functions 

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. 

• While performing the duties of this job, the employee is regularly required to talk or hear. The employee regularly is required to stand, walk, sit, use hand to finger, handle or feel objects, tools, or controls; and reach with hands and arms. 

• The employee frequently lifts and/or moves up to 10 pounds. Specific vision abilities required by this job include close vision and the ability to adjust focus. 

Pay Range: $64,384.00 - $96,577.00

Pay range may be based on a number of factors including market location, education, responsibilities, experience, etc.

Alignment Health is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, age, protected veteran status, gender identity, or sexual orientation.

*DISCLAIMER: Please beware of recruitment phishing scams affecting Alignment Health and other employers where individuals receive fraudulent employment-related offers in exchange for money or other sensitive personal information. Please be advised that Alignment Health and its subsidiaries will never ask you for a credit card, send you a check, or ask you for any type of payment as part of consideration for employment with our company. If you feel that you have been the victim of a scam such as this, please report the incident to the Federal Trade Commission at https://reportfraud.ftc.gov/#/. If you would like to verify the legitimacy of an email sent by or on behalf of Alignment Health’s talent acquisition team, please email [email protected].