Jobs in Boca Raton, FL

About the role

The Principal, DFIR & Threat Intelligence Analyst serves as the final technical authority and technical lead for an end-to-end cyber defense function that unifies Cyber Threat Intelligence (CTI), AI-augmented SOC monitoring, Incident Response (IR), Digital Forensics, and Malware Analysis into a single operational pipeline. Operating with an AI-first mindset, this position provides dedicated, hands-on-keyboard coverage from Thursday through Sunday, closing the weekend dwell-time gap and independently owning High and Critical security incidents end to end. As the sole hands-on DFIR responder during weekend shifts, you will command incidents, execute machine-speed containment, conduct deep-dive memory and cloud forensics, drive root-cause remediation, and author regulatory breach-determination recommendations. While carrying no direct reports, this terminal individual contributor role holds technical authority across the enterprise, setting detection and hunting methodologies, mentoring the broader security operations team, and briefing executive leadership.

What you'll bring

• Education & Experience: • Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Statistics, Mathematics, or a related technical discipline (or equivalent practical experience).
• Military & Veteran Substitution: Equivalent military experience in cyber operations, network defense, or signals intelligence (e.g., Army 17C/25D, Navy CTN, Air Force 1B4X1/1D7X1, USMC 17XX, or equivalent Space Force/Coast Guard cyber specializations across Active, Guard, or Reserve) fully substitutes for the degree requirement.
• 10+ years of progressive, hands-on experience in Digital Forensics, Incident Response (DFIR), SOC operations, and Cyber Threat Intelligence.
• 3+ years acting in a Principal, Lead, or Staff capacity overseeing complex enterprise breach responses and crisis command.
• Incident Command & Forensics: Proven record commanding High/Critical enterprise incidents
• hands-on expertise with host isolation (CrowdStrike RTR), memory analysis, storage volume forensics (EBS, EFS, FSx, S3), and container investigations under HIPAA, PCI DSS, SOC 2, or HITRUST standards.
• Cloud & Identity Mastery: Deep experience analyzing telemetry across large AWS organizations (100+ accounts), containerized environments (EKS), CI/CD pipelines, and enterprise identity architectures (Okta, Active Directory, Duo).
• Automation & Engineering: Proficient in engineering detection logic and queries in CQL, FQL, KQL, and SQL (Athena/OCSF), with scripting/automation capability in Python, PowerShell, or Bash.
• Threat Surface Defense: Proven experience designing hypothesis-driven threat hunts, directing Digital Risk Protection (secret leak tracking, domain takedowns), deploying deception networks (Thinkst Canary), and operationalizing CTI (Health-ISAC, CISA KEV).
• Schedule Requirement: Ability and willingness to work a dedicated weekend schedule (Thursday through Sunday) as the primary DFIR responder.
• Master’s degree in Cybersecurity, Computer Science, or related technical field.
• Industry certifications: • Core DFIR: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH).

Benefits