Looking for a job

Steven Li

@stevenli

I secure healthcare cloud, endpoint, identity, and network environments through detection engineering and incident response.

United States

Message

What I'm looking for

I'm looking to secure cloud, identity, endpoint, and healthcare environments through hands-on detection engineering, incident response, automation, vulnerability remediation, and compliance-focused security controls.

At iHealth Labs, I manage security operations for a healthcare environment of roughly 200 people, securing 290+ CrowdStrike-protected endpoints and 140+ Jamf-managed MacBooks.

I investigate events across AWS, endpoint, identity, SaaS, and network environments. During an EC2 compromise, I restricted an overly permissive security group, preserved an EBS snapshot, coordinated host analysis, and rebuilt the affected workload.

I build detection and automation workflows with CrowdStrike Falcon Fusion SOAR, LogScale, AWS CloudTrail, EventBridge, SNS, Lambda, and Jira. I also coordinate remediation for 1,000+ vulnerability findings, validate fixes, and strengthen IAM through SSO, MFA, RBAC, and least-privilege access patterns.

I've supported SOC 2 Type I through Type II and HIPAA assessments by implementing controls, organizing audit evidence, and coordinating remediation across IT, engineering, and compliance. Earlier at ZERO&, I supported endpoint operations and built JavaScript and Google Forms automation for internal service requests.

Experience

Work history, roles, and key accomplishments

Current

IT Security Analyst

Current

iHealth Labs Inc.

May 2022 - Present (4 years 4 months)

Managed security operations for a ~200-person healthcare environment, including 290+ CrowdStrike-protected endpoints and 140+ Jamf-managed MacBooks. Investigated security events across AWS, endpoint, identity, SaaS, and network environments, and built SOAR workflows for automated alerting.

IT Support Associate

ZERO&

Jun 2021 - May 2022 (11 months)

Supported Windows endpoints, business applications, hardware, and operational IT systems while providing troubleshooting to employees. Managed endpoint asset inventory and device lifecycle records, and developed a JavaScript/Google Forms automation workflow for internal service requests.