Principal IT Cyber Defense Analyst

Veradigm Inc; Pune District; Hybrid; INR 2,500,000 - 3,500,000; Full time

Job summary

Veradigm Inc. seeks a Principal Cyber Defense Analyst to oversee threat investigation, risk evaluation, and remediation guidance. You will lead advanced monitoring of SIEM and other security events, drive technical investigations, and assist in implementing a security roadmap to strengthen Allscripts' posture.

You will work with cross‑functional teams to ensure secure configurations and attend to high‑fidelity vulnerability findings while triaging incidents and mentoring junior staff.

Qualifications

• 7+ years of experience in cyber defense or SOC environments.
• Hands-on experience with EDR, SIEM, and incident response.
• Ability to advise development and operations teams on security best practices.

Responsibilities

• Oversee monitoring and analysis of network, endpoint, and database telemetry.
• Develop and tune detection rules in SIEM and log tools.
• Collaborate with SOC manager to escalate issues to other units.
• Lead technical investigations and remediation guidance.
• Maintain awareness of vulnerabilities, attacks, and mitigations.
• Provide consultation on secure design and implementation of security controls.
• Review security tickets from junior engineers and triage events.
• Contribute to security standards and best practices documentation.

Skills

Microsoft Defender for Endpoint

Crowdstrike Falcon

Intune policy deployment

Phishing and malware analysis

Vulnerability scanning tools

Microsoft Sentinel

Splunk

Network controls & VPN awareness

Identity lifecycle management

PowerShell scripting

Automox or Intune patching

Tools

Tenable

Qualys

Job description

The Principal Cyber Defense Analyst oversees the investigation and analysis of potential security threats,
evaluates risk, and provides guidance to remediate and implement appropriate security controls. This role is
responsible for the initial response and triage of security incidents, advanced monitoring of security events from
event management (SIEM) solutions, leading technical investigations, and assisting in the implementation of
recommendations to improve Allscripts security posture. The Principal Cyber Defense Analyst is a subject matter
expert in all SOC tolls and assists in the configuration and implementation of the security roadmap.

Job Description

• Oversees the monitoring and analysis of network, endpoint, and database telemetry from tools which
• include, but are not limited to: Endpoint Detection and Response (EDR), IDS/IPS, Firewalls, Active
• Directory, Windows Event Logs, Vulnerability Management tools
• Collaborates with the SOC manager to elevate security issues to other business units including solutions
• development, customer hosting and Corporate IT
• Independently works with security log tools and event management (SIEM) solutions to create correlation
• rules to aid in improved detection
• Maintains heightened awareness of current security vulnerabilities, attacks, and mitigation techniques, with
• regular and proactive communication to management on findings pertinent to Allscripts environment
• Independently identifies security vulnerabilities with high fidelity
• Provides consultation to development and operational teams in the appropriate application of security best
• practices and the use of advanced security technologies
• Provides consultation to operational teams in the tuning of security solutions and ensure their integrity
• Independently performs detailed security reviews to ensure design components are being securely
• implemented
• Participates in the definition and documentation of security standards and best practices
• Independently reviews and triages security tickets of junior engineers and events from multiple solutions
• 7+ years of experience required.

Required skills

• Microsoft Defender for Endpoint, Crowdstrike Falcon and exposure management
• Intune policy deployment / device compliance & encryption (BitLocker, FileVault)
• Phishing and malware analysis (sandbox tools)
• Vulnerability scanning tools (Tenable, Qualys, other)
• Microsoft Sentinel, Splunk or other SIEM experience
• Network controls, segmentation, VPN awareness
• Identity lifecycle (onboarding/offboarding, terminations, transfers)
• Microsoft Identity Manager (MIM), Azure AD / Entra ID
• SSO (SAML, OAuth, OIDC, WS-Fed) configuration
• Powershell scripting (Entra ID, Defender)
• Automox or Intune patching

Working Arrangements

US Hours & Hybrid [3 days WFO]