Cybersecurity Threat Intelligence Engineer II - Att@ck

Workforce Classification:

Hybrid

Join Our Team: Do Meaningful Work and Improve People’s Lives

Our purpose, to improve customers’ lives by making healthcare work better, is far from ordinary. And so are our employees. Working at Premera means you have the opportunity to drive real change by transforming healthcare.

Premera is committed to being a workplace where people feel empowered to grow, innovate, and lead with purpose. By investing in our employees and fostering a culture of collaboration and continuous development, we’re able to better serve our customers. It’s this commitment that has earned us recognition as one of the best companies to work for. Learn more about our recent awards and recognitions as a greatest workplace.

Learn how Premera supports our members, customers and the communities that we serve through our Healthsource blog: https://healthsource.premera.com/ .

Cybersecurity Threat Intelligence Engineer II, Att@ck

Join Premera’s Threat Intelligence and Response (TI&R) team as a Cybersecurity Threat Intelligence Engineer II, Att@ck . As part of Premera’s broader Purple Team capabilities, you will apply the MITRE ATT&CK framework and threat intelligence to evaluate the effectiveness of our security defenses through authorized adversary emulation, security testing, and detection validation.

In this role, you will develop and execute controlled testing scenarios that reproduce real-world attacker behaviors, assess security telemetry and detection capabilities, identify defensive gaps, and work closely with the Threat Intelligence and Incident Response teams within TI&R to strengthen Premera’s security posture. You will also help validate corrective actions and develop repeatable testing processes that demonstrate measurable improvements in our ability to detect and respond to relevant threats.

Success in this role requires technical curiosity, sound analytical judgment, strong documentation skills, and the ability to translate complex technical findings into clear, actionable recommendations for both technical and nontechnical stakeholders.

This is a hybrid role, located on our campus in Mountlake Terrace, Washington.

What You’ll Do

• •Plan and execute authorized adversary emulation, security testing, and technical assessments aligned with the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.
• •Research emerging adversary tactics, techniques, and procedures (TTPs), including those associated with nation-state actors and cybercriminal organizations, and translate relevant threat intelligence into practical, risk-based testing scenarios.
• •Reproduce adversary techniques within approved testing environments and established rules of engagement, ensuring activities comply with operational safety, privacy, and security requirements.
• •Collect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated attacker activity.
• •Collaborate with the Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation effectiveness.
• •Develop, maintain, and improve scripts, automation, and repeatable testing procedures to streamline adversary emulation, telemetry collection, security validation, and technical analysis.
• •Analyze testing results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement across Premera’s security capabilities.
• •Support incident response investigations and other assigned technical assessments by providing expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
• •Contribute to security assessments involving significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability assessment, and security control validation concepts.
• •Document testing methodologies, findings, limitations, and recommendations, and communicate results through written reports, technical discussions, and briefings appropriate for technical and nontechnical stakeholders.
• •Apply applicable security, privacy, regulatory, and organizational requirements when planning and performing assigned technical activities.
• •Organize and prioritize assigned work in alignment with team objectives, established procedures, and Purple Team initiatives while demonstrating sound judgment, initiative, and appropriate technical independence.
• •Share technical knowledge, lessons learned, and testing insights across the TI&R department to strengthen collective defensive capabilities.

What You'll Bring

Minimum Qualifications

• •Bachelor’s degree in Information Systems or Business Administration or four (4) years’ experience.
• •Three (3) years’ experience designing, implementing, and troubleshooting networked computer systems, including: systems integration, hardware requirements and network design planning; vendor negotiations for hardware and software; which must include:
• •Two (2) years’ experience with secure network and systems architecture, design and implementation, intrusion detection, defense and incident response, security configuration management, access controls design and implementation and security policy and standards development.

Preferred Qualifications

• •Industry-recognized offensive cybersecurity or adversary emulation certifications, such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN, GXPN, or eLearnSecurity eJPT/eCPPT.
• •Hands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
• •Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
• •Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.
• •Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
• •Hands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
• •Working knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.
• •Familiarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.
• •Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST, where relevant.

Premera total rewards

Our comprehensive total rewards package provides support, resources, and opportunities to help employees thrive and grow. Our total rewards are more than a collection of perks, they're a reflection of our commitment to your health and well-being. We offer a broad array of rewards including physical, financial, emotional, and community benefits, including:

Medical, vision, and dental coverage with low employee premiums.

Voluntary benefit offerings, including pet insurance for paw parents.

Life and disability insurance.

Retirement programs, including a 401K employer match and, believe it or not, a pension plan that is vested after 3 years of service.

Wellness incentives with a wide range of mental well-being resources for you and your dependents, including counseling services, stress management programs, and mindfulness programs, just to name a few.

Generous paid time off to reenergize.

Looking for continuing education? We have tuition assistance for both undergraduate and graduate degrees.

Employee recognition program to celebrate anniversaries, team accomplishments, and