Cybersecurity Threat Intelligence Engineer II - Att@ck

Premera Blue Cross is hiring a Cybersecurity Threat Intelligence Engineer II (Att@ck) for the Threat Intelligence and Response (TI&R) team, supporting authorized adversary emulation and defensive control validation using the MITRE ATT&CK framework.

Responsibilities

• Plan and execute authorized adversary emulation, security testing, and technical assessments mapped to the MITRE ATT&CK framework to evaluate defensive detection and visibility gaps.
• Research emerging adversary tactics, techniques, and procedures (TTPs), including nation-state and cybercriminal activity, then translate threat intelligence into risk-based testing scenarios.
• Reproduce adversary techniques in approved testing environments and within established rules of engagement, following operational safety, privacy, and security requirements.
• Collect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected controls detected, prevented, or responded appropriately.
• Collaborate with TI&R Threat Intelligence and Incident Response teams to review results, recommend defensive improvements, and perform follow-up testing to validate remediation.
• Develop and maintain scripts, automation, and repeatable testing procedures to improve adversary emulation, telemetry collection, security validation, and technical analysis.
• Analyze testing outcomes to identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement.
• Support incident response investigations and other assigned technical assessments using expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
• Contribute to security assessments involving significant changes to systems, applications, and networks by applying threat intelligence, vulnerability assessment, and security control validation concepts.
• Document testing methodologies, findings, limitations, and recommendations; communicate results via written reports, technical discussions, and briefings for technical and nontechnical stakeholders.
• Apply applicable security, privacy, regulatory, and organizational requirements when planning and performing technical activities.
• Organize and prioritize work aligned to team objectives, established procedures, and Purple Team initiatives, demonstrating sound judgment, initiative, and appropriate technical independence.
• Share technical knowledge, lessons learned, and testing insights across TI&R to strengthen collective defensive capabilities.

Requirements

• Bachelor’s degree in Information Systems or Business Administration OR four (4) years of relevant experience.
• Three (3) years of experience designing, implementing, and troubleshooting networked computer systems, including systems integration, hardware requirements and network design planning, and vendor negotiations for hardware and software.
• Must include Two (2) years of experience with secure network and systems architecture, design and implementation, intrusion detection, defense and incident response, security configuration management, access controls design and implementation, and security policy.

Preferred Qualifications

• Industry-recognized offensive cybersecurity or adversary emulation certifications such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN, GXPN, or eLearnSecurity eJPT/eCPPT.
• Hands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
• Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
• Scripting and automation experience using Python, PowerShell, Bash, or similar languages.
• Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
• Hands-on experience across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
• Knowledge of Windows and Linux, authentication technologies, networking protocols, and common attacker behaviors.
• Familiarity with threat intelligence analysis and threat hunting, including translating intelligence into actionable defensive testing scenarios.
• Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST (where relevant).

Technologies

• MITRE ATT&CK
• MITRE ATT&CK framework
• OffSec OSCP
• Zero-Point Security CRTO
• GIAC GPEN
• GXPN
• eLearnSecurity eJPT/eCPPT
• Python
• PowerShell
• Bash
• EDR
• SIEM
• Windows
• Linux
• HITRUST

Location and Work Style

• Mountlake Terrace, WA (hybrid)
• Workforce classification: Hybrid

Compensation

• Salary: USD 92,400 - 157,100 per year

Benefits

• Medical, vision, and dental coverage with low employee premiums.
• Voluntary benefits, including pet insurance for paw parents.
• Life and disability insurance.
• Retirement programs including a 401K employer match and a pension plan vested after 3 years of service.
• Wellness incentives with mental well-being resources for you and dependents, including counseling services, stress management programs, and mindfulness programs.
• Generous paid time off.
• Tuition assistance for undergraduate and graduate degrees.
• Employee recognition program for anniversaries, team accomplishments, and more.
• Free convenient on-site parking.
• Subsidized on-campus cafes.
• On-site activities such as health and wellness events, coffee connects, and disaster preparedness fairs.
• Complementary fitness and well-being center with in-person and virtual workouts and nutritional counseling.
• Commuter perks.