Purple Team Engineer – Risk & Exposure Management

Cardinal Health; Bengaluru; On-site; INR 2,500,000 - 4,000,000; Full time

Benefits offered by this job

Career development

Mentorship and learning opportunities

Global enterprise exposure

Job summary

Cardinal Health International India (CHII) seeks a seasoned Purple Team Engineer – Risk & Exposure Management to prioritize, quantify, and manage cyber risk across identity, cloud, network, and endpoints. You will bridge technical security teams with risk leadership and drive remediation aligned with business priorities.

Ideal candidates bring 5–8+ years in security operations, threat modeling, or risk management, with strong MITRE ATT&CK knowledge and communication skills to influence security

Qualifications

• 5–8+ years in security operations, threat modeling, or risk management.
• Strong knowledge of MITRE ATT&CK, vulnerabilities, and exploit lifecycles.
• Ability to translate security findings into business risk and communicate to leadership.

Responsibilities

• Analyze data from vulnerability management, threat intel, and red/purple team exercises to identify real risks.
• Model attack paths and exposure scenarios across identities, cloud, networks, and endpoints.
• Assess likelihood/impact of techniques with risk scoring and reporting frameworks (CVSS, context).
• Communicate risk posture to stakeholders and track remediation and residual risk.

Skills

Security operations

Threat modeling

Risk management

MITRE ATT&CK

Vulnerability management

Exploit lifecycles

Analytical skills

Communication skills

Education

Bachelor's degree in CS/IS

Tools

Attack surface management

Breach & attack simulation tools

AWS

Azure

GCP

Job description

Company Overview

Headquartered in Dublin, Ohio, Cardinal Health, Inc. (NYSE: CAH) is a global, integrated healthcare services and products company connecting patients, providers, payers, pharmacists and manufacturers for integrated care coordination and better patient management. Backed by nearly 100 years of experience, with more than 48,000 employees in nearly 60 countries, Cardinal Health ranks among the top 20 on the Fortune 500, America's Most Innovative Companies #51, Fortune Sector Leaders: Health Care #5 with a $223 billion of revenue in FY25.

About Cardinal Health International India (CHII)

Cardinal Health International India (CHII) is part of the Cardinal Health Global Technology and Business Services (GTBS) team. CHII leverages technology to offer scalable and healthcare solutions to enhance efficiency and improve quality of care across the value chain. Our vision is to build a world‑class capability center that is an intersection of tech‑innovation and learning, empowering our people to build solutions which will solve healthcare’s most complex challenges.

Department Overview

The Purple Team Engineer – Risk & Exposure Management focuses on prioritizing, quantifying, and managing cyber risk by correlating threat intelligence, vulnerability data, attack paths, and business impact. This role ensures the organization focuses remediation and defense efforts on the risks that matter most, not just individual findings. The engineer acts as a bridge between technical security teams and risk leadership, translating adversary behavior into measurable business exposure.

Key Responsibilities

• Analyze and correlate data from vulnerability management platforms, red team and purple team exercises, threat intelligence and exploit trends, attack surface management tools, and identify and prioritize real‑world exploitable risks rather than theoretical vulnerabilities.
• Model attack paths and exposure scenarios across identity, cloud environments, network and endpoint assets.
• Partner with red and blue teams to assess likelihood and impact of attack techniques, align technical findings to enterprise risk tolerance, and support risk scoring and reporting frameworks (e.g., CVSS + exploitability + business context).
• Communicate risk posture to security leadership, GRC and compliance teams, engineering and infrastructure owners; track remediation progress and residual risk; influence security investments based on risk reduction outcomes.

Required Qualifications

• 5–8+ years of experience in security operations, threat modeling, or risk management.
• Strong understanding of adversary tradecraft (MITRE ATT&CK), vulnerability management and exploit lifecycles, security control impact on risk reduction, experience translating technical security findings into business risk, and strong analytical and communication skills.

Preferred Qualifications

• Experience with attack surface management or breach and attack simulation tools.
• Experience with risk quantification models (FAIR or similar).
• Experience with cloud risk management (AWS, Azure, GCP).
• Background in purple teaming, red teaming, or detection engineering.
• Certifications such as CISSP, CRISC, GCIH, or other threat‑focused credentials.

Benefits

• Work for a Fortune 20 healthcare leader impacting millions of lives.
• Be part of a rapidly growing cybersecurity organization.
• Solve meaningful security challenges at global enterprise scale.
• Learn from experienced security leaders and technical experts.
• Access continuous learning, mentorship, and career development opportunities.
• Thrive in a collaborative, supportive, and innovation‑driven culture.

Join us in securing the future of healthcare while building a rewarding and impactful career.

Candidates who are back‑to‑work, people with disabilities, without a college degree, and Veterans are encouraged to apply.

Cardinal Health supports an inclusive workplace that values diversity of thought, experience and background. We celebrate the power of our differences to create better solutions for our customers by ensuring employees can be their authentic selves each day. Cardinal Health is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, ancestry, age, physical or mental disability, sex, sexual orientation, gender identity or expression, pregnancy, veteran status, marital status, creed, status with regard to public assistance, genetic status or any other status protected by federal, state or local law.