DM - Security (Chennai)

About Us: Our purpose is to help clients exceed their financial health goals. Across the reimbursement cycle, our scalable solutions and clinical expertise help solve programmatic needs. Enabling our teams with leading technology allows analytics to guide our solutions and keeps us accountable achieving goals. We build long-term careers by investing in YOU. We seek to create an environment that cultivates your professional development and personal growth, as we believe your success is our success. ESSENTIAL DUTIES AND RESPONSIBILITIES: Note: The essential duties and responsibilities below are intended to describe the general duties and responsibilities of this position and are not intended to be an exhaustive statement of duties. This position may perform all or most of the primary duties listed below. Specific tasks, responsibilities or competencies may be documented in the Team Members performance objectives as outlined by the Team Members immediate Leadership Team Member. Experience Overall 10 years of total experience, with 78 years of specialized expertise in Cybersecurity. Minimum 5 years of hands-on experience in a Security Operations Center (SOC) environment. ________________________________________ Core Responsibilities (L3 Level) Lead complex security incident investigations and provide expert-level forensics and technical analysis. Perform end to end incident management, including containment, eradication, recovery, and root-cause analysis. Act as a senior escalation point for L1/L2 analysts and guide them through complex investigations. Conduct proactive, intelligence-driven threat hunting to identify advanced and stealthy threats. Analyse multi-source security logs, correlate events, and detect sophisticated attack patterns. Investigate zero day vulnerabilities, newly reported CVEs, and emerging cyber threats. ________________________________________ SOC Operations & Enhancement Develop, refine, and maintain detection use cases, correlation rules, event logic, and alert thresholds. Provide SIEM & SOAR tuning and optimization to reduce false positives and improve detection fidelity. Enhance automation workflows within SOAR platforms to improve incident response efficiency. Maintain and continuously improve SOC playbooks, SOPs, and response templates. Drive improvements across SOC processes, SLAs, shift workflows, and operational maturity. Lead continuous improvement initiatives, focusing on detection gaps, tuning feedback loops, and new log onboarding. ________________________________________ Implementation & Projects Lead technical implementation and onboarding of new security tools, log sources, and integrations. Coordinate with platform teams to deploy, configure, and validate new security technologies. Oversee SIEM architecture enhancements, parser development, log ingestion, and normalization. Participate in deployment of EDR, UEBA, SOAR, Threat Intel, Network Security and other security platforms. Ensure successful end-to-end implementation: requirement gathering configuration testing go live. Drive continuous platform upgrades, configuration finetuning, and operational improvements. ________________________________________ Technical Expertise Strong understanding of cyberattacks, threat vectors, MITRE ATT&CK; techniques, malware behaviour, and incident response frameworks. Expertise across Windows, Linux, and Unix environments. Strong knowledge of TCP/IP, DNS, DHCP, routing, packet analysis, and network security architecture. Hands-on experience with: o SIEM (Splunk, QRadar, crowdstrike etc.) o IDS/IPS, UEBA, EDR, SSL inspection, Packet analysis tools o CrowdStrike Falcon (deep experience in policies, detection tuning, RTR, investigation) o SOAR platforms (automation playbooks, workflow creation, integration) o Ticketing systems such as JIRA, ServiceNow Strong expertise in Vulnerability Management, VAPT, and scanning activities (tools and remediation workflows). ________________________________________ Leadership & Collaboration Mentor, guide, and train L1 and L2 analysts on incident handling, detection techniques, and SOC maturity. Collaborate with cross-functional teams (Infra, IT, Cloud, Network, Risk, Application teams). Provide technical recommendations for remediation, risk reduction, and improved security posture. Create and deliver clear, actionable incident reports, executive summaries, and technical documentation. ________________________________________ Additional Responsibilities Monitor, assess, and respond to high severity alerts in a 247 SOC environment. Perform ongoing threat analysis, vulnerability assessment, and incident trend analysis. Participate in tabletop exercises, after-action reviews, and cyber readiness activities. Handle and support any additional SOC responsibilities as .