Manager Cyber Fusion Center

PDMI is looking to add a Manager, Cyber Fusion Center Manager to our team! The Manager, Cyber Fusion Center (CFC) is a senior cybersecurity leader responsible for building, maturing, and leading a modern cyber defense capability with incident response as a core area of expertise. This role oversees cyber incident response, data breach readiness, SOC operations, security engineering, cloud and product security. The ideal candidate combines deep technical knowledge with strong leadership, communication, and strategy skills to design and operationalize an AI-enabled SOC in partnership with internal teams and external MSSPs, solution providers and other partners. Since 1984, PDMI has provided pharmacy data processing and other flexible, scalable solutions to help our clients meet their business objectives. We offer transparent, pass-through pharmacy processing and other services for private label Pharmacy Benefit Managers (PBMs), vertically integrated health plans and hospital systems. In addition to Pharmacy Benefit Administrative Services, we offer 340B Administration, Hospice and Long-Term Care Services. Why Join Us: Best Employer: PDMI was voted Best Employer in Ohio for the 5th consecutive year in 2025! Meaningful Work: Contribute to improving healthcare quality and efficiency. Collaborative Environment: Work with passionate professionals who share your drive. Exciting Challenges: Every day brings new opportunities to excel. Flexible Work: Fully remote opportunity with a company that cares. Key Responsibilities: Lead the strategy, design, implementation, operation and continuous improvement of a Cyber Fusion Center including Security Operations Center (SOC) aligned to business risk and enterprise security objectives. Oversee SOC operations across internal teams and external providers, including MSSPs, and AI-enabled SOC platforms. Serve as the primary leader for cybersecurity incident response, including preparation, detection, triage, containment, eradication, recovery, and post-incident review. Lead or coordinate response to high-severity cybersecurity incidents, data breaches, and crisis events; stand up and run CSIRT activities when needed. Develop, maintain, and test the incident response plan, escalation procedures, and cybersecurity playbooks using frameworks such as MITRE ATT&CK and other industry best practices. Ensure SOC alerts and triage workflows are mapped, prioritized, and tuned using the MITRE ATT&CK framework, cyber threat intelligence, and risks it brings to PDMI. Drive operational excellence in monitoring, detection engineering, threat triage, and response workflows to reduce false positives and improve speed and quality of response. Partner with vulnerability management, security engineering, infrastructure, architecture, product security, risk management, legal, IT operations, and product engineering & owners to improve detection, response, and remediation outcomes. Lead security input into enterprise initiatives involving Microsoft Defender EDR, Entra ID / Active Directory, Penetration Testing, Red & Purple team exercise, Email Security, CSPM/Cloud Security, KnowBe4 and broader security telemetry integration. Establish and track operational metrics and KPIs such as alert fidelity, MTTD, MTTR, incident trends, log ingestion coverage gaps, and control effectiveness. Manage third-party incident response retainers, forensic partners, and external service providers to ensure readiness and effective support during incidents. Plan and facilitate cybersecurity tabletop exercises and simulations with technical teams, executives, and business stakeholders to validate readiness and strengthen decision-making. Provide clear, concise updates to leadership during incidents and communicate cyber risk, trends, and improvement priorities to executive team. Word & Education Experience Requirements: Bachelor’s degree in computer science, cybersecurity, or a related technical field required or equivalent combination of education and experience. 8-10 years of progressive experience in cybersecurity with significant experience in incident response, SOC operations, security engineering, or cyber defense leadership required. Proven experience designing, implementing, or operating SOC and experience in SIEM, SOAR required. Strong hands-on and strategic knowledge of security operations platforms, endpoint detection and response, identity security, vulnerability management, and cloud security required. Experience leading major incident response efforts, coordinating technical and business stakeholders, and managing executive communications during cyber events required. Strong understanding of network protocols, secure system design, logging solutions, and endpoint security required. Proficient in various scripting languages to automate repetitive tasks and streamline security operations required. Experience with industry standards and frameworks (e.g., NIST IR, NIST RMF, MITRE, CIS) required. Security certifications such as CISSP and CISM are preferred. AI Usage & Candidate Authenticity: AI tools may be used for resume formatting or drafting application materials; however, submitting content that misrepresents your experience, including copied job descriptions or unverifiable work history, is not acceptable. Candidates must be prepared to clearly and confidently speak to all experience listed. PDMI may request work samples, portfolio links, or other forms of validation during the process. Use of AI tools during interviews or assessments, unless explicitly permitted, will result in disqualification. All offers are contingent upon successful completion of a pre-employment background check, including employment and education verification, as well as a 4-panel drug screen.