Strategic Cyber Threat Analyst - Remote or Hybrid from MN or DC

UnitedHealth Group•Eden Prairie, MN

3d•Hybrid

About The Position

Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together. Join UnitedHealth Group if you want to be the first-line defense against securing the largest healthcare company in the world against security threats. We are focused on transformation by strengthening our cyber defenses, ransomware resiliency, mitigating vulnerabilities, and better securing all aspects of our company, globally. We are vigilant and passionate about protecting the sensitive data of our members and providers and are committed to leveraging every tool, partnership, and process needed to enhance our security posture. It is our duty to protect the information of those we serve and help fulfill our mission of making the health care system work better for everyone. As a Senior Cybersecurity Analyst on the Strategic Team within the Cyber Threat Intelligence Team, you will inform senior leadership and security teams about major cyber threats, trends, and key cybersecurity developments. Your experience in intelligence will support a variety of cross-cutting CTI projects, and your ability to effectively analyze and distill large datasets to draw out relevant trends and highlight risks to the organization is essential provide timely, relevant, and actionable analysis to our stakeholders. Experience in cyber intelligence, threat landscape, and actor knowledge, combined with experience using intelligence platforms, performing trend and risk analysis, and writing clear, concise strategic reports are all key to success in this role. You’ll enjoy the flexibility to work remotely from anywhere within the U.S. as you take on some tough challenges. For all hires in the Minneapolis or Washington, D.C. area, you will be required to work in the office a minimum of four days per week.

Requirements

5+ years of combined experience in at least four of the following:
Experience using structured analytic techniques to help develop sound analytic conclusions
Experience using threat intelligence platforms and associated threat feeds, and collecting, analyzing, interpreting, and reporting threat data, with a focus on relevant geopolitical, industry, and business context
Experience mentoring and supporting junior analysts on analyzing and conveying cyber-related threats and risks to senior executives
Analyzing, tracking, and reporting of cyber threats to industry, threat actors, and associated TTPs
Using the Diamond Model for Intrusion Analysis to cluster, track, and group threat activities. Using the Lockheed Martin Cyber Kill Chain to depict and analyze discreet phases of adversary operations. And using the MITRE ATT&CK framework of adversary operational TTP’s to identify and categorize threat actor activity
Identifying connections between adversary tools, infrastructure, personas, and suspected affiliations using link analysis models
Open and/or closed source intelligence gathering methods and processes
5+ years of Cybersecurity experience
Experience writing concise, informed strategic cyber threat intelligence reports for a range of audiences, including senior executives and both technical and non-technical stakeholders
Experience briefing strategic cyber threat intelligence and trend analysis for a range of audiences, including senior executives and both technical and non-technical stakeholders

Nice To Haves

Security related certificates, such as: GCTI, CISSP, GPEN, GCIH, GREM
Experience in a government or military intelligence agency
Knowledge of various APT, cybercrime, and other advanced threat actors
Knowledge of common intrusion tactics, techniques, and countermeasures
Deep understanding of the current threat landscape and associated risks
Understanding of conventions and models for intelligence attribution and intrusion clustering
Proven threat concepts and frameworks (CVSS, CVE, MITRE ATT&CK, STIX/TAXII, YARA, FAIR)
Proven ability to read, analyze and interpret general business periodicals, professional journals, technical procedures, or governmental regulations
Proven ability to effectively present information and respond to questions from groups of employees, managers, clients, and customers
Proven ability to interpret a variety of instructions furnished in written, oral, diagram or schedule form

Responsibilities

Monitor threat landscape to identify new trends and risks facing the industry, and tactics, techniques, and procedures employed by threat actors
Manage intelligence requirements from internal stakeholders across operations, engineering, risk management, leadership, and others, soliciting feedback to continually drive improvements
Provide relevant, timely, and actionable cyber threat analysis and support to senior leadership, requiring the ability to convey key assessments for both technical and non-technical audiences
Perform research and collection across the intelligence spectrum to support requests for information from internal stakeholders and teams
Conduct trending and correlation analysis across threat intelligence data to establish patterns, and identify proactive mitigations and countermeasures
Develop threat intelligence reporting based on research and analysis on both a regular cadence and ad hoc as needed
Develop, manage, optimize, and continuously improve processes to enhance the overall cyber threat intelligence function
Identify and track threats targeting the organization and industry
Support the broader enterprise during incidents and other threat monitoring activities providing intelligence context, expertise, and remediation recommendations
Maintain relationships with external partners and other healthcare organizations
Serve as a mentor to other intelligence analysts and facilitate collaboration on the team
Independently run programs and projects on the team