Cybersecurity Threat Intelligence Engineer II - Att@ck

Premera Blue Cross•Mountlake Terrace, WA

8d•Hybrid

About The Position

Premera is hiring a Cybersecurity Threat Intelligence Engineer II to join its Threat Intelligence and Response (TI&R) team and contribute to the organization’s Purple Team capabilities. The role applies the MITRE ATT&CK framework and threat intelligence to evaluate security defenses through authorized adversary emulation, security testing, and detection validation. The engineer develops controlled scenarios based on real-world attacker behaviors, assesses telemetry and detection capabilities, identifies defensive gaps, and works with Threat Intelligence and Incident Response teams to strengthen Premera’s security posture. The role also validates corrective actions and develops repeatable testing processes to measure improvements in threat detection and response. The position calls for technical curiosity, analytical judgment, strong documentation, and the ability to communicate technical findings as actionable recommendations to technical and nontechnical audiences. It is a hybrid role based on Premera’s campus in Mountlake Terrace, Washington. Activities must follow approved rules of engagement and applicable operational safety, privacy, security, regulatory, and organizational requirements.

Requirements

Bachelor’s degree in Information Systems or Business Administration, or four years of experience.
Three years of experience designing, implementing, and troubleshooting networked computer systems, including systems integration, hardware requirements, network design planning, and vendor negotiations for hardware and software.
Two years of experience with secure network and systems architecture, design and implementation; intrusion detection, defense and incident response; security configuration management; access controls design and implementation; and security policy and standards development.

Nice To Haves

Industry-recognized offensive cybersecurity or adversary emulation certifications, such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN or GXPN, or eLearnSecurity eJPT or eCPPT.
Hands-on proficiency with MITRE ATT&CK, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.
Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
Hands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
Working knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.
Familiarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.
Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST where relevant.

Responsibilities

Plan and execute authorized adversary emulation, security testing, and technical assessments aligned with MITRE ATT&CK to evaluate defensive controls and identify detection and visibility gaps.
Research emerging adversary tactics, techniques, and procedures, including those associated with nation-state actors and cybercriminal organizations, and translate relevant intelligence into risk-based testing scenarios.
Reproduce adversary techniques in approved testing environments and within established rules of engagement, complying with operational safety, privacy, and security requirements.
Collect, analyze, and document testing evidence and security telemetry to assess whether defensive controls detected, prevented, or appropriately responded to simulated activity.
Collaborate with Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation.
Develop, maintain, and improve scripts, automation, and repeatable procedures for adversary emulation, telemetry collection, security validation, and technical analysis.
Analyze results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement.
Support incident response investigations and other technical assessments with expertise in adversary behavior, attack techniques, telemetry, and detection capabilities.
Contribute to security assessments involving significant system, application, and network changes, applying threat intelligence, vulnerability assessment, and security control validation concepts.
Document methodologies, findings, limitations, and recommendations, and communicate results through reports, technical discussions, and briefings for technical and nontechnical audiences.
Apply relevant security, privacy, regulatory, and organizational requirements when planning and performing technical work.
Organize and prioritize assigned work in line with team objectives, procedures, and Purple Team initiatives, demonstrating sound judgment, initiative, and appropriate technical independence.
Share technical knowledge, lessons learned, and testing insights across the TI&R department.

Benefits

Medical, vision, and dental coverage with low employee premiums.
Voluntary benefits, including pet insurance.
Life and disability insurance.
Retirement programs, including a 401(k) employer match and a pension plan vested after three years of service.
Wellness incentives and mental well-being resources, including counseling, stress management, and mindfulness programs.
Generous paid time off.
Tuition assistance for undergraduate and graduate degrees.
Employee recognition program.
Hybrid employees have access to on-campus resources, networking opportunities, and team engagement.
Commuter perks.
Free on-site parking.
Subsidized on-campus cafes.
On-site activities, including health and wellness events, coffee connects, and disaster preparedness fairs.
Fitness and well-being center with in-person and virtual workouts and nutritional counseling.