Lead Cybersecurity Operations Analyst

Providence Global Center; Hyderabad; On-site; INR 2,500,000 - 4,200,000; Full time

Benefits offered by this job

Competitive Pay

Supportive Reporting Relation

Job summary

Providence Global Center in Hyderabad, India seeks a Lead Cybersecurity Operations Analyst (Threat Hunter) to proactively identify, investigate, and mitigate advanced cyber threats. You will use threat intelligence, hypothesis-driven hunting, and analytics across endpoints, network, cloud, and identity to uncover malicious activity beyond traditional controls.

The role requires hands-on experience with MITRE ATT&CK, SIEM/EDR, and SOAR platforms, plus scripting skills (Python/PowerShell).

Qualifications

• Understanding of cyber-attack lifecycles and adversary behavior.
• Experience with MITRE ATT&CK framework and threat hunting.
• Proficiency with SIEM and SOAR platforms and EDR/XDR tools.
• Knowledge of Windows, Linux, AD/Entra ID, Azure, networking protocols.

Responsibilities

• Conduct proactive threat hunting across endpoints, network, cloud, identity, and email.
• Develop hypotheses based on emerging threats and attacker TTPs.
• Analyze telemetry using SIEM, EDR/XDR, Cloud Security, and related tools.
• Investigate Indicators of Compromise and Indicators of Attack.
• Align findings with the MITRE ATT&CK framework.
• Create and refine threat detection rules and analytics.
• Perform digital forensics and incident analysis.
• Produce technical and executive threat hunting reports.
• Develop SOAR playbooks and response playbooks.

Skills

Threat hunting

MITRE ATT&CK

KQL

Python

PowerShell

SIEM

EDR/XDR

Documentation

Education

GIAC Threat Hunter

GCFA/GNFA

MAD - ATT&CK Defender

Tools

CrowdStrike Falcon

Cortex XSOAR

Microsoft Defender

SIEM Platforms

Job description

Select how often (in days) to receive an alert:

Providence, one of the US’s largest not-for-profit healthcare systems, is committed to high quality, compassionate healthcare for all. Driven by the belief that health is a human right and the vision, ‘Health for a better world’, Providence and its 121,000 caregivers strive to provide everyone access to affordable quality care and services.

Providence has a network of 51 hospitals, 1,000+ care clinics, senior services, supportive housing, and other health and educational services in the US.

Providence India is bringing to fruition the transformational shift of the healthcare ecosystem to Health 2.0. The India center will have focused efforts around healthcare technology and innovation, and play a vital role in driving digital transformation of health systems for improved patient outcomes and experiences, caregiver efficiency, and running the business of Providence at scale.

Why Us?

• Competitive Pay
• Supportive Reporting Relation

Job Description – Lead Cybersecurity Operations Analyst (Threat Hunter)

Job Title

Lead Cybersecurity Operations Analyst

Role Summary:

The Threat Hunter is tasked with the proactive identification, investigation, and mitigation of advanced cyber threats within PGC enterprise environments. The candidate will utilize threat intelligence, hypothesis-driven hunting, behavior analytics, and advanced detection techniques to uncover malicious activities not addressed by traditional security controls.

Key Responsibilities:

• Conduct proactive threat hunting across endpoints, network, cloud, identity, and email environments.
• Develop and implement threat hunting hypotheses based on emerging threats and adversary tactics, techniques, and procedures.
• Analyze security telemetry using platforms such as SIEM, EDR/XDR, Cloud Security, Data Security, EASM, email security gateways, Threat Intelligence, Dark Web monitoring, identity management, SOAR, Case Management, and various log sources.
• Investigating Indicators of Compromise and Indicators of Attack.
• Align threat hunting and investigation findings with the MITRE ATT&CK framework.
• Create and refine threat detection rules, use cases, and behavioral analytics based on threat hunting outcomes and investigations to enhance security monitoring coverage.
• Conduct digital forensic and incident analysis to determine the scope and impact of attacks.
• Produce technical reports and executive summaries detailing threat hunting activities.
• Perform triage, investigation, and response to security incidents.Development of SOAR playbooks.

Required Skills/Qualifications:

• Comprehensive understanding of cyber-attack lifecycles and adversary behavior.
• Expertise in the MITRE ATT&CK framework.
• Experience with SIEM and SOAR platforms, such as CrowdStrike Falcon Next-Gen SIEM and Palo Alto Network Cortex XSOAR.
• Hands-on experience with EDR/XDR solutions, including Microsoft Defender and CrowdStrike Falcon.
• In-depth knowledge of Windows, Linux, Active Directory/Entra ID, Azure Cloud Platform, and networking protocols (DNS, HTTP(s), SMTP, LDAP, TCP/IP).
• Proficiency in Kusto Query Language (KQL), SQL, and scripting languages such as Python and PowerShell.
• Understanding of malware analysis and digital forensics.
• Strong analytical, communication, and documentation skills.

Preferred Qualifications:

• Over 9 years of experience in cybersecurity, with at least 6 years in threat hunting.
• Relevant certifications such as GIAC Certified Threat Hunter (GCTI/GCTH), GIAC Certified Forensic Analyst (GCFA/GNFA), MITRE ATT&CK Defender (MAD – All modules), GAIC GCTI, or equivalent certifications.

Providence’s vision to create ‘Health for a Better World’ aids us to provide a fair and equitable workplace for all in our employment, whether temporary, part-time or full time, and to promote individuality and diversity of thought and background, and acknowledge its role in the organization’s success. This makes us committed towards equal employment opportunities, regardless of race, religion or belief, color, ancestry, disability, marital status, gender, sexual orientation, age, nationality, ethnic origin, pregnancy, or related needs, mental or sensory disability, HIV Status, or any other category protected by applicable law. In furtherance to our mission in building a more inclusive and equitable environment, we shall, from time to time, undertake programs to assist, uplift and empower underrepresented groups including but not limited to Women, PWD (Persons with Disabilities), LGTBQ+ (Lesbian, Gay, Transgender, Bisexual or Queer), Veterans and others. We strive to address all forms of discrimination or harassment and provide a safe and confidential process to report any misconduct.

Providence Global Center 8th Floor, Skyview 1083/1, Raidurgam,
Hitech City Main Rd, Hyderabad, Telangana 500081, India