Principal Information Security Analyst

Mayo Clinic • Rochester, MN

6d • $134,347 - $194,750

About The Position

The Principal Information Security Analyst serves as a senior leader within Mayo Clinic’s Cybersecurity Threat Intelligence team, advancing the team’s capabilities, maturity, and impact. The role delivers complex intelligence work, establishes direction and repeatable practices, mentors and influences others, and integrates intelligence into Cyber Defense and enterprise decision-making.

The analyst independently identifies, collects, validates, analyzes, and disseminates intelligence from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources. The role develops Mayo-specific intelligence and connects cyber, physical, operational, reputational, insider, research, executive, and business risks to provide decision-relevant intelligence for Cyber Defense and enterprise stakeholders.

The position leads capability development and complex intelligence initiatives; develops intelligence requirements and assessments; produces reports, briefings, and operational intelligence; conducts advanced OSINT investigations; engages government, law-enforcement, healthcare-sector, and industry partners; and builds collaboration across Mayo Clinic functions. The role supports threat hunting, detection development, incident response, investigations, and enterprise risk decisions. The position is not eligible for visa sponsorship or transfer, and Mayo Clinic does not participate in the F-1 STEM OPT extension program.

Requirements

• Bachelor’s degree in an applicable field and eight years of relevant experience, or a master’s degree in an applicable field and five years of relevant experience.
• Applicable fields include information security, computer science, information systems, risk management, or a related field.
• At least one of the following certifications, or an equivalent, is required at time of hire: CISSP, CISM, GSEC, or OSCP.

Responsibilities

• Set direction for enterprise threat intelligence capabilities and translate strategic priorities into an actionable intelligence roadmap.
• Establish standards, methods, repeatable workflows, feedback mechanisms, and measures to improve intelligence quality, consistency, timeliness, and operational value.
• Lead complex and ambiguous intelligence initiatives involving Cyber Defense, security, risk, investigative, technical, and business functions.
• Mentor analysts, share tradecraft, and strengthen team capabilities in structured analysis, OSINT, enterprise intelligence, government engagement, and executive communication.
• Influence priorities, identify capability gaps, recommend investments and partnerships, and serve as a senior enterprise advisor.
• Develop and maintain intelligence requirements aligned with Mayo Clinic priorities and Cyber Defense and enterprise stakeholder needs.
• Identify, collect, validate, and analyze information from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources.
• Produce actionable intelligence on threat actors, campaigns, malware, vulnerabilities, tactics, techniques, procedures, and emerging risks.
• Conduct adversary profiling and threat actor research using MITRE ATT&CK and other intelligence frameworks.
• Apply structured analytic techniques, link analysis, metadata analysis, infrastructure analysis, geolocation, and digital-footprint research to complex intelligence questions.
• Develop strategic, operational, and tactical assessments tailored to Mayo Clinic, including threats affecting healthcare delivery, research, executives, personnel, and critical operations.
• Produce recurring intelligence reports, threat assessments, executive briefings, investigative products, and time-sensitive operational intelligence.
• Translate intelligence findings into implications and recommended actions for Threat Hunting, Detection Engineering, Security Validation, Incident Response, Red Team, and other Cyber Defense functions.
• Develop Mayo-specific intelligence by connecting multiple sources, identifying patterns, and converting fragmented information into actionable assessments.
• Support threat actor attribution, campaign tracking, trend analysis, intelligence-led hunting, detection development, validation activities, and complex cyber investigations.
• Assess commercial and partner-provided intelligence for operational relevance and enrich it with enterprise context.
• Conduct advanced OSINT investigations using public, commercial, and specialized intelligence resources.
• Research threat activity across the surface web, social media, underground forums, dark web, digital infrastructure, and other relevant environments.
• Investigate cyber-enabled fraud, threats to personnel, insider threats, reputational risks, intellectual-property concerns, cyber-enabled physical threats, and emerging threat activity.
• Develop investigative intelligence supporting Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, and other enterprise partners.
• Maintain analytical objectivity, source integrity, and appropriate handling practices when collecting and disseminating sensitive intelligence.
• Establish, maintain, and leverage relationships with federal, state, and local government, law-enforcement, intelligence, healthcare-sector, and information-sharing partners.
• Represent Cybersecurity Threat Intelligence in intelligence exchanges, working groups, briefings, and partner engagements.
• Coordinate intelligence activities with government agencies, law enforcement, industry partners, information-sharing organizations, and external intelligence providers.
• Facilitate timely two-way intelligence sharing during significant cyber incidents, investigations, or threat events.
• Translate externally sourced intelligence into Mayo Clinic-specific risk context and operational actions.
• Identify intersections among cyber, operational, physical, reputational, executive, research, and business risks and translate them into intelligence relevant to enterprise stakeholders.
• Build working relationships across Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, Legal, Compliance, and other business and security functions.
• Improve awareness of intelligence activities across Mayo Clinic, identify collaboration opportunities, and reduce unnecessary duplication of effort.
• Communicate intelligence to technical, operational, executive, and nontechnical audiences.
• Support leadership with decision-relevant intelligence briefings and risk assessments, and advise on emerging threats and security trends.

Benefits

• Medical plan options.
• Dental coverage through Delta Dental or a reimbursement account for flexible coverage.
• Vision plan with a national network.
• Health Savings Account and Flexible Spending Accounts for eligible expenses.
• Competitive retirement package.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal