Cyber Security Manager

R1 is a leading provider of technology-driven solutions that help hospitals and health systems to manage their financial systems and improve patients experience. We are the one company that combines the deep expertise of a global workforce of revenue cycle professionals with the industry's most advanced technology platform, encompassing sophisticated analytics, Al, intelligent automation and workflow orchestration. R1 is a place where we think boldly to create opportunities for everyone to innovate and grow. A place where we partner with purpose through transparency and inclusion. We are a global community of engineers, front-line associates, healthcare operators, and RCM experts that work together to go beyond for all those we serve. Because we know that all this adds up to something more, a place where we're all together better

R1 India is proud to be recognized amongst Top 25 Best Companies to Work For 2024, by the Great Place sto Work Institute. This is our second consecutive recognition on this prestigious Best Workplaces list, building on the Top 50 recognition we achieved in 2023. Our focus on employee wellbeing and inclusion and diversity is demonstrated through prestigious recognitions with R1 India being ranked amongst Best in Healthcare, Top 100 Best Companies for Women by Avtar & Seramount, and amongst Top 10 Best Workplaces in Health & Wellness. We are committed to transform the healthcare industry with our innovative revenue cycle management services. Our goal is to make healthcare work better for all by enabling efficiency for healthcare systems, hospitals, and physician practices. With over 30,000 employees globally, we are about 16,000+ strong in India with presence in Delhi NCR, Hyderabad, Bangalore, and Chennai. Our inclusive culture ensures that every employee feels valued, respected, and appreciated with a robust set of employee benefits and engagement activities.

Job Title: Manager - Cybersecurity Incident Management

Location: Noida (With some travel to Gurgaon)

Work Mode: Hybrid

Work Shift Timing: 1 PM to 10 PM IST

Position Summary: -

We at R1 RCM are seeking a highly skilled and collaborative Cybersecurity Incident Management Manager to lead our organization's response to cybersecurity threats and data privacy incidents. This role manages the full lifecycle of security events—from detection through investigation, containment, and resolution—while ensuring compliance with regulatory requirements such as HIPAA, HITECH, contractual requirements from clients, state breach notification laws. The ideal candidate brings expertise in both technical incident response and privacy risk management, with hands-on experience using platforms like Microsoft Sentinel, AI automation technologies, ServiceNow for orchestration, case management, and reporting.

Key duties & responsibilities: -

Incident Response Leadership:

• Lead the detection, triage, investigation, containment, and remediation of cybersecurity and privacy-related incidents.
• Serve as the central coordinator for major incidents involving PHI/PII exposure, ransomware, insider threats, or unauthorized access.
• Use technology suite including SIEM, DLP, EDR etc. for threat detection, analytics and action taking.

Breach & Regulatory Compliance:

• Maintain documentation for incident timelines, decisions, and mitigation activities in ServiceNow.

Tooling, Playbooks & Workflow Automation:

• Improve playbooks for recurring incidents for pragmatic risk management and remediation
• Leverage ServiceNow to manage incident workflows, escalation paths, SLA tracking, evidence handling, and audit trail documentation.
• Integrate threat intelligence feeds and automated alerts into both platforms to accelerate detection and containment.

Threat Intelligence & continuous improvement

• Structure threat intelligence and threat hunting activities into incident response workflows to enhance detection capabilities.
• Collaborate with the Threat Intelligence team to assess potential indicators of compromise (IOCs) and emerging attack vectors.
• Identify trends and lessons learned to continuously mature the incident management framework and reduce mean time to detect/respond.

Metrics, Root Cause Analysis & Reporting:

• Track incident response metrics and generate regular reports and dashboards for leadership, compliance, and audit stakeholders.
• Conduct root cause analysis and lead post-incident review meetings, documenting lessons learned and recommending improvements.
• Drive continuous improvement of the incident response program, including integration of new use cases and remediation actions.

Stakeholder Communication & Training:

• Develop internal training for operational teams to improve breach recognition and response preparedness
• Participate in tabletop exercises and readiness testing with business units and leadership

Experience, Skills and Knowledge

• 7–9 years of experience in cybersecurity and privacy incident response, preferably in a regulated environment (e.g., healthcare, finance, SaaS).
• Strong understanding of HIPAA, HITECH, GDPR, CCPA, and state/federal breach notification laws.
• Experience managing incidents using SIEM and ticketing management systems such as Microsoft Sentinel and ServiceNow
• Familiarity with EDR, DLP tools, data flow mapping, forensic investigation, and threat intelligence integration.

Nice to Have Certifications (Not Mandatory)

• Certified Information Security Manager (CISM)
• Certified Information Systems Security Professional (CISSP)
• Certified in Risk and Information Systems Control (CRISC)