Cybersecurity Threat Intelligence Engineer II - Att@ck

Premera Blue Cross•Mountlake Terrace, WA

9d•$92,400 - $157,100•Hybrid

About The Position

Join Premera’s Threat Intelligence and Response (TI&R) team as a Cybersecurity Threat Intelligence Engineer II, Att@ck. As part of Premera’s broader Purple Team capabilities, you will apply the MITRE ATT&CK framework and threat intelligence to evaluate the effectiveness of security defenses through authorized adversary emulation, security testing, and detection validation. Develop and execute controlled testing scenarios that reproduce real-world attacker behaviors, assess security telemetry and detection capabilities, identify defensive gaps, and collaborate with the Threat Intelligence and Incident Response teams within TI&R to strengthen Premera’s security posture. Help validate corrective actions and develop repeatable testing processes that demonstrate measurable improvements in detecting and responding to relevant threats. The role calls for technical curiosity, analytical judgment, strong documentation skills, and the ability to translate complex technical findings into clear, actionable recommendations for technical and nontechnical stakeholders. This is a hybrid role located on Premera’s campus in Mountlake Terrace, Washington.

Requirements

Bachelor’s degree in Information Systems or Business Administration, or four years of experience.
Three years of experience designing, implementing, and troubleshooting networked computer systems, including systems integration, hardware requirements and network design planning, and vendor negotiations for hardware and software.
Two years of experience with secure network and systems architecture, design and implementation; intrusion detection, defense and incident response; security configuration management; access controls design and implementation; and security policy and standards development.

Nice To Haves

Industry-recognized offensive cybersecurity or adversary emulation certifications, such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN or GXPN, or eLearnSecurity eJPT/eCPPT.
Hands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.
Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
Hands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
Working knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.
Familiarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.
Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST, where relevant.

Responsibilities

Plan and execute authorized adversary emulation, security testing, and technical assessments aligned with the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.
Research emerging adversary tactics, techniques, and procedures (TTPs), including those associated with nation-state actors and cybercriminal organizations, and translate relevant threat intelligence into practical, risk-based testing scenarios.
Reproduce adversary techniques in approved testing environments and under established rules of engagement, complying with operational safety, privacy, and security requirements.
Collect, analyze, and document technical evidence and security telemetry from testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated activity.
Collaborate with Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation effectiveness.
Develop, maintain, and improve scripts, automation, and repeatable testing procedures for adversary emulation, telemetry collection, security validation, and technical analysis.
Analyze testing results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement of Premera’s security capabilities.
Support incident response investigations and other assigned technical assessments with expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
Contribute to security assessments involving significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability assessment, and security control validation concepts.
Document testing methodologies, findings, limitations, and recommendations, and communicate results through written reports, technical discussions, and briefings for technical and nontechnical stakeholders.
Apply applicable security, privacy, regulatory, and organizational requirements when planning and performing assigned technical activities.
Organize and prioritize assigned work in alignment with team objectives, established procedures, and Purple Team initiatives, demonstrating sound judgment, initiative, and appropriate technical independence.
Share technical knowledge, lessons learned, and testing insights across the TI&R department to strengthen collective defensive capabilities.

Benefits

Medical, vision, and dental coverage with low employee premiums.
Voluntary benefits, including pet insurance.
Life and disability insurance.
Retirement programs, including a 401K employer match and a pension plan vested after three years of service.
Wellness incentives and mental well-being resources, including counseling, stress management, and mindfulness programs.
Generous paid time off.
Tuition assistance for undergraduate and graduate degrees.
Employee recognition program.
On-campus resources, networking opportunities, and team engagement for hybrid employees.
Commuter perks.
Free on-site parking.
Subsidized on-campus cafes.
On-site activities, including health and wellness events, coffee connects, and disaster preparedness fairs.
Fitness and well-being center with in-person and virtual workouts and nutritional counseling.