Cybersecurity Threat Intelligence Engineer II - Att@ck

Premera Blue Cross is hiring a Cybersecurity Threat Intelligence Engineer II, Att&ck, for the Threat Intelligence and Response (TI&R) team in a hybrid setup in Mountlake Terrace, WA. In this role, you will use the MITRE ATT&CK framework to plan and run authorized adversary emulation and security testing, evaluate control performance via telemetry, and support repeatable, risk-based validation of defensive improvements.

Responsibilities

• Plan and execute authorized adversary emulation, security testing, and technical assessments mapped to the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.
• Research emerging adversary tactics, techniques, and procedures (TTPs), including those linked to nation-state actors and cybercriminal organizations, and convert threat intelligence into practical, risk-based testing scenarios.
• Reproduce adversary techniques within approved testing environments and established rules of engagement, ensuring work complies with operational safety, privacy, and security requirements.
• Collect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated attacker activity.
• Collaborate with TI&R Threat Intelligence and Incident Response teams to assess findings, recommend defensive improvements, and perform follow-up testing to validate remediation effectiveness.
• Develop, maintain, and improve scripts, automation, and repeatable testing procedures to streamline adversary emulation, telemetry collection, security validation, and technical analysis.
• Analyze testing outcomes to identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement across Premera’s security capabilities.
• Support incident response investigations and other assigned technical assessments by providing expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
• Contribute to security assessments tied to significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability assessment, and security control validation concepts.
• Document testing methodologies, findings, limitations, and recommendations, and communicate results through written reports, technical discussions, and briefings for both technical and nontechnical stakeholders.
• Apply applicable security, privacy, regulatory, and organizational requirements when planning and performing assigned technical activities.
• Organize and prioritize assigned work aligned with team objectives, established procedures, and Purple Team initiatives, demonstrating sound judgment, initiative, and appropriate technical independence.
• Share technical knowledge, lessons learned, and testing insights across the TI&R department to strengthen collective defensive capabilities.

Requirements

• Bachelor’s degree in Information Systems or Business Administration or four (4) years’ experience.
• Three (3) years’ experience designing, implementing, and troubleshooting networked computer systems, including systems integration, hardware requirements and network design planning, and vendor negotiations for hardware and software.
• Two (2) years’ experience with secure network and systems architecture, design and implementation, including intrusion detection, defense and incident response, security configuration management, access controls design and implementation, and security policy.

Preferred Qualifications

• Industry-recognized offensive cybersecurity or adversary emulation certifications such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN, GXPN, or eLearnSecurity eJPT/eCPPT.
• Hands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
• Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
• Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.
• Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
• Hands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
• Working knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.
• Familiarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.
• Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST, where relevant.

Technologies

• MITRE ATT&CK, MITRE ATT&CK framework
• OffSec OSCP
• Zero-Point Security CRTO
• GIAC GPEN
• GXPN
• eLearnSecurity eJPT/eCPPT
• Python, PowerShell, Bash
• EDR, SIEM
• Windows, Linux
• HITRUST

Location and Work Style

• Mountlake Terrace, WA (hybrid)

Compensation

• USD 92,400 - 157,100 per year

Benefits

• Medical, vision, and dental coverage with low employee premiums.
• Voluntary benefit offerings, including pet insurance.
• Life and disability insurance.
• Retirement programs, including a 401K employer match and a pension plan vested after 3 years of service.
• Wellness incentives, including mental well-being resources for you and your dependents such as counseling services, stress management programs, and mindfulness programs.
• Generous paid time off.
• Tuition assistance for undergraduate and graduate degrees.
• Employee recognition program to celebrate anniversaries, team accomplishments, and more.
• Free convenient on-site parking.
• Subsidized on-campus cafes.
• On-site activities such as health and wellness events, coffee connects, disaster preparedness fairs, and more.
• Complementary fitness and well-being center offers in-person and virtual workouts and nutritional counseling.
• Commuter perks.

Workforce Classification

• Hybrid