Principal Cybersecurity Analyst (Attack Surface Mgt.) On Site MN

UnitedHealth Group•Columbia, MD

2d•$112,700 - $193,200•Remote

About The Position

The Principal Cybersecurity Analyst will provide senior technical leadership on the Attack Surface Management (ASM) team within Optum Technology’s Enterprise Information Security organization. The role protects the global enterprise by identifying, mapping, assessing, and managing exposure across internal and external digital assets in complex multi-cloud and on-premises environments. The analyst partners with cyber defense, threat intelligence, vulnerability management, engineering, and other teams to identify security blind spots, evaluate risk, and develop automated reconnaissance and remediation workflows. The position also uses enterprise-approved AI tools and automation to improve operational efficiency and proactive cyber resilience.

Requirements

At least 5 years of experience in cybersecurity, information security, or security operations.
At least 5 years of dedicated experience in attack surface management, external exposure monitoring, vulnerability assessment, or threat intelligence.
At least 3 years of experience assessing asset configurations and security postures across major public cloud platforms such as AWS, Azure, or GCP.
At least 3 years of hands-on experience with enterprise ASM, threat exposure, or vulnerability discovery platforms such as Cortex Xpanse, Censys, Tenable, Qualys, or Shodan.
Experience in cyber threat intelligence and/or an investigatory role.
Strong technical, analytical, and business communication and writing abilities.
Availability to support daily operations and, on an ad hoc basis, off-hour war room efforts.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.
Experience developing scripts with Python, Bash, or PowerShell and using REST APIs for automated data collection, alerting, and workflow integration.
Industry-recognized cybersecurity certifications such as CISSP, CISM, CEH, OSCP, or GIAC certifications such as GCIH or GPEN.
Cloud security certifications such as AWS Certified Security – Specialty or Microsoft Certified: Azure Security Engineer Associate.
Experience using approved AI productivity and data analysis tools to augment security evaluations, synthesize threat data, or automate routine tasks.
Understanding of cybersecurity frameworks and taxonomies such as MITRE ATT&CK, NIST CSF, OWASP Top 10, and CIS Critical Security Controls.
Experience in large-scale, distributed enterprise environments subject to healthcare regulations such as HIPAA or HITRUST, or financial industry standards.

Responsibilities

Lead the strategic expansion and daily execution of the enterprise Attack Surface Management program, building visibility into external and internal digital assets across multi-cloud and on-premises environments.
Continuously discover, validate, and analyze the risk of public-facing infrastructure, cloud environments, domains, APIs, and third-party dependencies to identify vulnerabilities and misconfigurations.
Partner with Threat Intelligence, Vulnerability Management, and Red Team operations to correlate exposure data with active threats and prioritize remediation.
Design, build, and deploy automated discovery, scanning, and notification pipelines to accelerate detection and remediation.
Use enterprise-approved AI tools to streamline workflows, automate tasks, and improve vulnerability assessment and attack surface analysis.
Evaluate emerging trends to inform solution design, security architecture, and strategic innovation in attack surface management.
Collaborate with cloud engineering, DevOps, and IT application owners to enable remediation and embed security controls in continuous deployment pipelines.
Perform QA/QC on team member tickets and tasks, and mentor and guide junior and mid-level analysts.
Identify and implement process improvements and improve cross-functional collaboration.
Maintain the team documentation library, standard operating procedures, and technical playbooks.
Enhance vendor relationships and support to improve tooling effectiveness and service delivery.