Principal Cyber Security Analyst

Tegria•Pennsylvania, PA

About The Position

Tegria is seeking a Principal Cyber Security Analyst to serve as a senior technical authority protecting healthcare and claims environments. The role leads threat detection, incident response, risk assessment, and security architecture review for systems handling protected health information (PHI), personally identifiable information (PII), and payment data. It partners with Engineering, Claims Operations, Compliance, and Legal to protect sensitive data and meet regulatory obligations, while mentoring analysts across the security organization. The analyst leads investigations into complex security incidents, develops and tunes security detections and response playbooks, conducts threat hunting and intelligence analysis, coordinates breach assessments and notifications, and drives remediation after incidents. The position also performs and oversees security risk assessments, supports audits and due diligence, evaluates third-party risk, and reports risk posture to senior leadership. The role reviews security architecture for healthcare claims and related applications, advises on cloud and data-protection controls, and embeds security practices throughout the SDLC. It safeguards claims data, monitors privileged and role-based access, and collaborates on minimum-necessary access, retention, and de-identification practices. As technical lead and escalation point for Tier 2 and Tier 3 analysts, it mentors staff and communicates technical risks to varied audiences.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent experience.
8+ years of progressive information security experience, including 3+ years in healthcare, health insurance, or claims processing.
Hands-on experience with SIEM tools such as Splunk, Sentinel, or QRadar; EDR tools such as CrowdStrike, Defender, or SentinelOne; and vulnerability management tools.
Deep knowledge of HIPAA/HITECH, PHI handling requirements, and breach response obligations.
Demonstrated experience leading incident response in a regulated environment.
Working knowledge of cloud security, IAM, network security, and encryption.
Familiarity with healthcare data standards and workflows (EDI X12, HL7, FHIR) and claims lifecycle processes.
Strong written and verbal communication skills.

Nice To Haves

Certifications such as CISSP, CISM, CCSP, GCIH, GCIA, GCFA, HCISPP, or CISA.
Experience with HITRUST, SOC 2, or PCI DSS assessments.
Experience with payer, TPA, PBM, or healthcare clearinghouse environments.
Familiarity with MITRE ATT&CK, Zero Trust, and scripting for automation (Python, PowerShell).
Knowledge of healthcare fraud, waste, and abuse (FWA) patterns and related data analytics.
Experience with medical device or IoMT security.

Responsibilities

Lead investigation and response for complex security incidents, including ransomware, business email compromise, insider threats, and suspected PHI breaches.
Develop and tune detection use cases, correlation rules, and playbooks in SIEM, EDR, and SOAR platforms.
Conduct threat hunting and threat intelligence analysis, with emphasis on healthcare-targeted threat actors.
Direct breach assessment and coordinate notification activities with Privacy, Legal, and Compliance under HIPAA and state breach laws.
Perform post-incident reviews and drive remediation of root causes.
Perform and oversee security risk assessments aligned to HIPAA Security Rule, HITRUST CSF, NIST CSF, NIST 800-53, and SOC 2.
Support internal and external audits, client security questionnaires, and payer/provider due diligence.
Assess third-party and vendor risk, including clearinghouses, TPAs, cloud providers, and business associates.
Maintain risk registers and report risk posture to senior leadership.
Review architecture and design for claims adjudication, EDI (837/835), eligibility, provider portals, and member-facing applications.
Advise on cloud security, identity and access management, encryption, network segmentation, and data loss prevention.
Embed security into the SDLC, including threat modeling, secure code review, and vulnerability management.
Ensure appropriate controls for data in transit and at rest, including HL7, FHIR, and API-based data exchange.
Safeguard claims data against fraud, unauthorized access, and exfiltration.
Monitor privileged and role-based access to claims platforms, data warehouses, and analytics environments.
Collaborate with Privacy and Compliance on minimum-necessary access, data retention, and de-identification practices.
Serve as technical lead and escalation point for Tier 2 and Tier 3 analysts.
Mentor junior and mid-level staff and contribute to training and tabletop exercises.
Communicate complex technical risks clearly to executive and non-technical stakeholders.