Job Description

R1 India is proud to be recognized among the Top 20 of India's Best Companies to Work For 2025 by the Great Place to Work® Institute, marking our third consecutive year of climbing the ranks - from Top 50 in 2023 to Top 25 in 2024, and now amongst the Top 20. This achievement is a testament to the exceptional workplace culture we have collectively cultivated and reflects our unwavering commitment to employee well-being, inclusion, and diversity. Our accolades also highlight our excellence in healthcare, support for millennials, women, diversity, and health and wellness.

With over 30,000 employees globally and a robust presence in India, comprising over 17,000 employees across Delhi NCR, Hyderabad, Bangalore, and Chennai, we foster an inclusive culture where every team member feels valued and empowered. Our mission is to transform the healthcare industry by driving efficiency for healthcare systems, hospitals, and physician practices, continuously striving to make healthcare work better for everyone.

Job Requirement

We are looking for a self-motivated Cybersecurity Analyst to join the R1 Cybersecurity Operations Team. We have a relentless focus on driving results for our customers and enabling them to invest more in patient care; in turn, this allows us to continue to grow our company and your career.

The successful candidate must be well-versed in security operations, cyber security tools, intrusion detection, and secured networks. They will serve as an expert and be responsible for providing network and security operations technical analysis, assessment, and recommendations in the areas of real-time security situational awareness, operational network system and applications systems security monitoring.

Responsibilities:

Monitoring various security tools (e.g., CrowdStrike, Proofpoint, MS Sentinel, Azure VM) to identify potential incidents, network intrusions, and malware events, etc. to ensure confidentiality, integrity, and availability of R1’s architecture and information systems are protected
Reviewing and analyzing log files to report any unusual or suspect activities.
Utilize incident response use-case workflows to follow established and repeatable processes for triaging and escalating.
Generating trouble tickets and performing initial validation and triage to determine whether incidents are security events using open-source intelligence (OSINT)
Following established incident response procedures to ensure proper escalation, analysis and resolution of security incidents.
Analyzing and correlating incident event data to develop preliminary root cause and corresponding remediation strategy.
Providing technical support for new detection capabilities, recommendations to improve upon existing tools/capabilities to protect the R1’s network, and assessments for High Value Assets.
In this role, the successful candidate will maintain and monitor compliance with enterprise change management policies and procedures.
Develop and maintain metrics & reports on the status of the R1 cyber security operations program.
Attend and participate in Cyber security projects and the change management process. This includes interacting with business units and technical teams to understand what is coming and how their projects can be more secure from the beginning.
As part of the overall Cybersecurity Operations Team, work in tandem with the security operations center (SOC), incident responders (when anomalous activity and host compromise occurs), and technology infrastructure and development team members.
Participate in established incident response procedures to ensure proper escalation, analysis and resolution of security events and incidents.
Managing and maintaining change detection and auditing tools
Researching technology and application processing environments, operation, and associated user workflow to design, build, configure, implement, and document change compliance and audit rules within designated technologies.
Reconciling changes detected by the system to authorized changes documented in service desk and change management applications.
Analyzing large volumes of security event data from a variety of sources to identify suspicious and malicious activity.
Documenting, logging and investigating security incidents.
Performing case management throughout the incident lifecycle for moderately complex security incidents
Design, build, and documenting security technology standards, processes, and operational workflows
Operating and maintaining physical security monitoring systems
Review, investigate, track, and monitor viruses and malware propagation and eradication throughout the enterprise.
Monitoring compliance with enterprise security, compliance, and change management programs, policies, and processes
Researching Threat Intelligence sources on the latest malware, trends, patches in order to keep the Security Program up-to-date.
Providing metrics & reports on the status of tools, environments, and assets within the organization.
Database and Application security to prevent attacks via Input Validation, Cross-Site Scripting, Buffer Overflow…etc

Required Qualifications:

A minimum of 4 years of professional experience in an IT-related field
Intermediate knowledge of security, monitoring, and networking technologies, tools, protocols and standards
Knowledge of security policy, programs, process, and metrics
CompTIA Security+ certification or equivalent professional experience in security operations
Intermediate or advanced security, networking, or audit certification
Recent experience with static and/or dynamic code review process
Strong drive and passion to deliver distinctive end-products, a quick learner with a strong attention to detail and quality.
Excellent interpersonal and communication skills

Desired Qualifications:

A Bachelor’s degree in a technical discipline (e.g., Computer Science, Business Analyst, etc.)
Certification (or ability to obtain certification) in at least one of the following areas: General Security (CISSP), Incident Handling (GCIH), Cloud Security (GCLD, Cloud+, CCSK), and Ethical Hacking (CEH)
Experience with advanced cyber security tools, network topologies, intrusion detection, and secured networks
In-depth understanding of NIST SP 800-61, SOC 2 AICPA controls and frameworks.