Principal Information Security Analyst

Mayo Clinic • Rochester, MN

6d • $134,347 - $194,750

About The Position

The Principal Information Security Analyst is a senior leader on Mayo Clinic’s Cybersecurity Threat Intelligence team. The role advances team capabilities, maturity, and impact by setting direction, developing repeatable intelligence practices, mentoring and influencing others, and integrating intelligence into Cyber Defense and enterprise decision-making. The analyst independently identifies, collects, validates, analyzes, and disseminates intelligence from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources, with an emphasis on developing Mayo-specific intelligence.

The position connects cyber, physical, operational, reputational, insider, research, executive, and business risks and translates those connections into decision-relevant intelligence for Cyber Defense and enterprise stakeholders. It leads complex intelligence initiatives, produces assessments and briefings, supports cyber investigations and defense activities, conducts advanced OSINT investigations, and develops trusted external partnerships. The position is not eligible for visa sponsorship or transfer, and Mayo Clinic does not participate in the F-1 STEM OPT extension program.

Requirements

• Bachelor’s degree in an applicable field and eight years of relevant experience, or a master’s degree in an applicable field and five years of relevant experience.
• Applicable fields include information security, computer science, information systems, risk management, or a related field.
• At least one of the following certifications, or equivalent, is required at time of hire: CISSP, CISM, GSEC, or OSCP.

Responsibilities

• Set direction for enterprise threat intelligence capabilities and translate strategic priorities into an actionable intelligence roadmap.
• Establish standards, methods, repeatable workflows, feedback mechanisms, and measures to improve intelligence quality, consistency, timeliness, and operational value.
• Lead complex and ambiguous intelligence initiatives across Cyber Defense, security, risk, investigative, technical, and business functions.
• Mentor analysts, share tradecraft, and strengthen team capabilities in structured analysis, OSINT, enterprise intelligence, government engagement, and executive communication.
• Influence priorities, identify capability gaps, recommend investments and partnerships, and serve as a senior enterprise advisor.
• Develop and maintain intelligence requirements aligned with Mayo Clinic priorities and stakeholder operational needs.
• Identify, collect, validate, and analyze information from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources.
• Produce actionable intelligence on threat actors, campaigns, malware, vulnerabilities, tactics, techniques, procedures, and emerging risks.
• Conduct adversary profiling and threat actor research using MITRE ATT&CK and other relevant intelligence frameworks.
• Apply structured analytic techniques, link analysis, metadata analysis, infrastructure analysis, geolocation, and digital-footprint research.
• Develop strategic, operational, and tactical assessments tailored to Mayo Clinic, including threats affecting healthcare delivery, research, executives, personnel, and critical operations.
• Produce recurring intelligence reports, threat assessments, executive briefings, investigative products, and time-sensitive operational intelligence.
• Translate intelligence findings into implications and recommended actions for Threat Hunting, Detection Engineering, Security Validation, Incident Response, Red Team, and other Cyber Defense functions.
• Develop Mayo-specific intelligence by connecting multiple sources, identifying patterns, and converting fragmented information into actionable assessments.
• Support threat actor attribution, campaign tracking, trend analysis, intelligence-led hunting, detection development, validation activities, and complex cyber investigations.
• Assess commercial and partner-provided intelligence for operational relevance and enrich it with enterprise context.
• Conduct advanced OSINT investigations using public, commercial, and specialized intelligence resources.
• Research threat activity across the surface web, social media, underground forums, dark web, digital infrastructure, and other relevant environments.
• Investigate cyber-enabled fraud, threats to personnel, insider threats, reputational risks, intellectual-property concerns, cyber-enabled physical threats, and emerging threat activity.
• Develop investigative intelligence for Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, and other enterprise partners.
• Maintain analytical objectivity, source integrity, and appropriate handling practices when collecting and disseminating sensitive intelligence.
• Establish and maintain trusted relationships with government, law-enforcement, intelligence, healthcare-sector, and information-sharing partners.
• Represent Cybersecurity Threat Intelligence in intelligence exchanges, working groups, briefings, and partner engagements.
• Coordinate intelligence activities with government agencies, law enforcement, industry partners, information-sharing organizations, and external intelligence providers.
• Facilitate timely two-way intelligence sharing during significant cyber incidents, investigations, or threat events.
• Translate externally sourced intelligence into Mayo Clinic-specific risk context and operational actions.
• Identify intersections among cyber, operational, physical, reputational, executive, research, and business risks and translate them into intelligence for enterprise stakeholders.
• Build working relationships across Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, Legal, Compliance, and other business and security functions.
• Improve awareness of intelligence activities across Mayo Clinic, identify collaboration opportunities, and reduce unnecessary duplication.
• Communicate intelligence to technical, operational, executive, and nontechnical audiences.
• Support leadership with decision-relevant intelligence briefings and risk assessments, and advise on emerging threats and security trends.

Benefits

• Medical coverage with multiple plan options.
• Dental coverage through Delta Dental or a reimbursement account for flexible coverage.
• Vision plan with a national network.
• HSA and FSAs for eligible expenses.
• Competitive retirement package.
• Continuing education and advancement opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior