Principal Reverse Engineer

UnitedHealth Group • Eden Prairie, MN

309d • $106,800 - $194,200 • Remote

About The Position

UnitedHealth Group is a health care and well-being company that's dedicated to improving the health outcomes of millions around the world. We are comprised of two distinct and complementary businesses, UnitedHealthcare and Optum, working to build a better health system for all. Here, your contributions matter as they will help transform health care for years to come. Make an impact with a diverse team that shares your passion for helping others. Join us to start Caring. Connecting. Growing together. Join UnitedHealth Groups Enterprise Information Security (EIS) organization if you want to be the first-line defense against securing the largest healthcare company in the world against security threats. We are focused on transformation by strengthening our cyber defenses, ransomware resiliency, mitigating vulnerabilities, and better securing all aspects of our company, globally. We are vigilant and passionate about protecting the sensitive data of our members and providers and are committed to leveraging every tool, partnership and process needed to enhance our security posture. It is our duty to protect the information of those we serve and help fulfill our mission of making the health care system work better for everyone. The Principal Reverse Engineer will join the Reverse Engineering unit, which is part of our Cyber Threat Intelligence Team and involved in the body of technologies, processes, and practices designed to protect and defend networks, computers, programs, and data from attack, damage, theft, or unauthorized access, including firewall, digital forensics, investigative services, and incident management. You'll enjoy the flexibility to work remotely from anywhere within the U.S. as you take on some tough challenges.

Requirements

• 5+ years of combined experience in operational security techniques for conducting online research and analysis
• Analyzing, tracking, and reporting of common threats and malware
• Analyzing, tracking, and reporting of advanced threat actor groups and associated TTPs
• Using the Diamond Model for Intrusion Analysis to cluster, track, and group threat activities
• Lockheed Martin Cyber Kill Chain to depict and analyze discreet phases of adversary operations
• MITRE ATT&CK framework of adversary operational TTP's
• Identifying connections between adversary tools, infrastructure, personas, and suspected affiliations using link analysis models
• 5+ years of experience managing threat intelligence platforms and associated threat feeds coupled with collecting, analyzing, interpreting, and reporting threat data
• 5+ years of hands on experience performing dynamic malware analysis
• 5+ years working with Linux, OS X, UNIX, and Windows operating systems
• 5+ years of experience utilizing decompilers such as Ghidra, IDA Pro, or Binary Ninja
• 5+ years of experience with security technologies such as Sysmon, Procmon, FlareVM toolset, etc.
• 2+ years of experience mentoring and supporting junior analysts

Nice To Haves

• Bachelor's degree
• GIAC Reverse Engineering Malware Certification (GREM) or other related certifications

Responsibilities

• Perform dynamic and static malware analysis using non-automated sandboxes
• Contribute to the internal reverse engineering playbooks
• Design and assess procedures for effective malware analysis
• Monitor threat feeds for relevant information
• Monitor threat landscape to identify new tactics, techniques and procedures employed by threat actors and update associated profiles
• Manage intelligence requirements from internal stakeholders across operations, engineering, risk management and others, soliciting feedback to continually drive improvements
• Perform research and collection across the intelligence spectrum to support requests for information from internal teams
• Contribute to threat intelligence reports regarding current activities
• Develop, manage, optimize and continuously improve processes to enhance the overall cyber threat intelligence function
• Support Incident Response and Engineering teams during incidents and other threat monitoring activities providing intelligence context, remediation recommendations and expertise
• Maintain relationships with external partners such as the FBI, DHS, NH-ISAC, and other healthcare organizations

Benefits

• Comprehensive benefits package
• Incentive and recognition programs
• Equity stock purchase
• 401k contribution

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Industry: Insurance Carriers and Related Activities
• Education Level: Bachelor's degree