Principal Information Security Analyst

Mayo Clinic•Rochester, MN

About The Position

The Principal Information Security Analyst serves as a senior leader within the Cybersecurity Threat Intelligence team, advancing the team's capabilities, maturity, and impact. The role delivers complex intelligence work while setting direction, establishing repeatable practices, mentoring others, and integrating intelligence into Cyber Defense and enterprise decision-making. The analyst independently identifies, collects, validates, analyzes, and disseminates intelligence from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources. The role develops Mayo-specific intelligence by connecting information across cyber, physical, operational, reputational, insider, research, executive, and business risks and translating those connections into decision-relevant intelligence. The position produces strategic, operational, and tactical assessments, investigative products, executive briefings, and time-sensitive intelligence. It supports threat hunting, detection development, security validation, incident response, red-team activities, and complex investigations. The analyst also conducts advanced OSINT investigations, develops trusted external partnerships, and advises enterprise stakeholders on emerging threats and security trends. This vacancy is not eligible for sponsorship; Mayo Clinic will not sponsor or transfer visas for this position. Mayo Clinic does not participate in the F-1 STEM OPT extension program.

Requirements

Bachelor’s degree in an applicable field and eight years of relevant experience, or a master’s degree in an applicable field and five years of relevant experience.
Applicable fields include information security, computer science, information systems, risk management, or a related field.
At least one of the following certifications, or an equivalent, is required at the time of hire: CISSP, CISM, GSEC, or OSCP.

Responsibilities

Set direction for enterprise threat intelligence capabilities and translate strategic priorities into an actionable intelligence roadmap.
Establish standards, methods, repeatable workflows, feedback mechanisms, and measures to improve intelligence quality, consistency, timeliness, and operational value.
Lead complex intelligence initiatives involving Cyber Defense, security, risk, investigative, technical, and business functions.
Mentor analysts, share tradecraft, and strengthen team capabilities in structured analysis, OSINT, enterprise intelligence, government engagement, and executive communication.
Identify capability gaps, recommend investments and partnerships, influence priorities, and serve as a senior advisor across the enterprise.
Develop and maintain intelligence requirements aligned with Mayo Clinic priorities and stakeholder needs.
Identify, collect, validate, and analyze information from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources.
Produce actionable intelligence on threat actors, campaigns, malware, vulnerabilities, tactics, techniques, procedures, and emerging risks.
Conduct adversary profiling and threat actor research using MITRE ATT&CK and other relevant intelligence frameworks.
Apply structured analytic techniques, link analysis, metadata analysis, infrastructure analysis, geolocation, and digital-footprint research to complex intelligence questions.
Develop strategic, operational, and tactical assessments tailored to Mayo Clinic, including threats affecting healthcare delivery, research, executives, personnel, and critical operations.
Produce recurring intelligence reports, threat assessments, executive briefings, investigative products, and time-sensitive operational intelligence.
Translate intelligence findings into implications and recommended actions for Threat Hunting, Detection Engineering, Security Validation, Incident Response, Red Team, and other Cyber Defense functions.
Develop Mayo-specific intelligence by connecting information from multiple sources, identifying patterns, and turning fragmented information into actionable assessments.
Support threat actor attribution, campaign tracking, trend analysis, intelligence-led hunting, detection development, validation activities, and complex cyber investigations.
Assess the operational relevance of commercial and partner-provided intelligence and enrich it with enterprise context.
Conduct advanced OSINT investigations using public, commercial, and specialized intelligence resources.
Research threat activity across the surface web, social media, underground forums, dark web, digital infrastructure, and other relevant environments.
Investigate cyber-enabled fraud, threats to personnel, insider threats, reputational risks, intellectual-property concerns, cyber-enabled physical threats, and emerging threat activity.
Develop investigative intelligence for Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, and other enterprise partners.
Preserve analytical objectivity, source integrity, and appropriate handling practices when collecting and disseminating sensitive intelligence.
Establish and maintain trusted relationships with federal, state, and local government, law-enforcement, intelligence, healthcare-sector, and information-sharing partners.
Represent Cybersecurity Threat Intelligence in intelligence exchanges, working groups, briefings, and partner engagements.
Coordinate intelligence activities with government agencies, law enforcement, industry partners, information-sharing organizations, and external intelligence providers.
Facilitate timely two-way intelligence sharing during significant cyber incidents, investigations, or threat events.
Translate externally sourced intelligence into Mayo Clinic-specific risk context and operational actions.
Identify intersections among cyber, operational, physical, reputational, executive, research, and business risks and translate them into intelligence for enterprise stakeholders.
Build working relationships across Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, Legal, Compliance, and other business and security functions to coordinate intelligence activities.
Improve awareness of intelligence activities across Mayo Clinic, identify collaboration opportunities, and reduce unnecessary duplication of effort.
Communicate intelligence to technical, operational, executive, and nontechnical audiences.
Support leadership with decision-relevant intelligence briefings and risk assessments and serve as a trusted advisor on emerging threats and security trends.