Security Operations Engineer

Claritev helps make healthcare more transparent and affordable through data, technology, and expertise. The Security Operations Engineer will protect networks, systems, and data by operating security tooling, improving detections and automation, and responding to cybersecurity threats. The role collaborates with IT, infrastructure, cloud, application, and compliance teams across monitoring, incident response, threat hunting, and security operations.

Responsibilities:

• Monitor, improve, and maintain security events and alerts across the enterprise using SIEM, EDR, and detection telemetry tools; triage and respond to potential incidents in a timely manner
• Develop and manage detection rules, correlation logic, and automated playbooks (SOAR) to improve response times
• Analyze and tune security tools to reduce false positives and improve detection fidelity
• Design, deploy, and maintain security infrastructure, including networking, cloud tooling, endpoint protection, and email security gateways
• Analyze and triage security alerts to determine legitimacy, severity, and business impact
• Identify and implement detections for indicators of compromise (IOCs), suspicious behavior, and emerging threats
• Perform continuous threat monitoring and situational awareness activities
• Support penetration testing and red team exercises; validate and remediate identified findings
• Develop and document security operating procedures, runbooks, and incident response plans
• Stay current on emerging threats, attacker tactics/techniques/procedures (TTPs), and industry best practices (e.g., MITRE ATT&CK)
• Lead or support incident response efforts, including containment, eradication, recovery, and root-cause analysis
• Investigate cybersecurity incidents including malware infections, phishing attacks, account compromises, insider threats, and unauthorized access attempts
• Execute incident response procedures, best practices, and playbooks
• Document findings, actions taken, and lessons learned for post mortems
• Escalate significant incidents according to established procedures
• Perform vulnerability assessments and coordinate remediation with system and application owners
• Develop and refine detection use cases based on threat intelligence and incident trends
• Conduct threat hunting activities to proactively identify indicators of compromise and advanced persistent threats
• Utilize threat intelligence feeds and data analysis to enrich investigations
• Research emerging threats, vulnerabilities, and attack techniques
• Assist with security architecture reviews for new systems, applications, and cloud deployments
• Collaborate with compliance teams to support audits and ensure adherence to relevant frameworks (NIST, ISO 27001, SOC 2, FedRAMP, HITRUST, PCI-DSS, etc.)
• Provide on-call support for security incidents outside of normal business hours as needed
• And other duties as assigned

Requirements:

• Bachelor's degree in computer science, Information Security, or related field, or equivalent practical experience
• 5+ years of experience in cybersecurity operations, security engineering, or a related role
• Strong understanding of networking fundamentals (TCP/IP, DNS, routing, firewalls) and operating systems (Windows, Linux)
• Hands-on experience managing SIEM platforms (e.g., Splunk, QRadar, Sentinel) and EDR/XDR tools (e.g., CrowdStrike, SentinelOne, Defender)
• Experience with incident response methodologies and digital forensics investigations
• Familiarity with scripting/automation (Python, PowerShell, Bash) for security tooling and response automation
• Knowledge of common attack techniques, malware behavior, and the MITRE ATT&CK framework
• Understanding of cloud security concepts (AWS, Azure, or Oracle OCI)
• Strong analytical, problem-solving, and communication skills
• Ability to work independently and manage competing priorities in a fast-paced environment
• Relevant certifications such as GCIH, GCIA, GSEC, GCFA, CEH, CISSP, or OSCP
• Experience managing SIEM, SOAR, & EDR platforms and security tools
• Familiarity with managing detection lifecycles and tuning detections
• Experience with cloud-native security tools (e.g. External Attack Surface Management (EASM), Continuous Threat Exposure Management (CTEM), GenAI Control Towers, Data Detection, and Secure Email Gateways (SEG))
• Background in threat intelligence analysis
• Prior experience in a regulated industry (finance, healthcare, government, defense)