About This Role
This cybersecurity analyst role is within the Cyber Threat Intelligence (CTI) team, focusing on monitoring emerging threats, collecting and enriching intelligence, and performing technical analysis of adversary capabilities. The role involves translating findings into actionable intelligence for various security teams and requires a candidate who can work with diverse internal and external sources.
Responsibilities
- Monitor and analyze emerging cyber threats, threat actor tactics, techniques, and procedures (TTPs), third-party incidents, and vulnerabilities relevant to the organization
- Evaluate intelligence sources and distinguish reliable technical evidence from unverified reporting or low-confidence attribution
- Perform technical analysis of malicious infrastructure, IP addresses, domains, URLs, certificates, and email artifacts using passive DNS, WHOIS/RDAP, and internet scanning data
- Analyze malware and suspicious files using static/dynamic analysis techniques, sandbox environments, and reverse-engineering tools as appropriate
- Produce clear technical intelligence reports, briefings, and profiles detailing adversary capabilities, confidence levels, and recommended defensive actions
- Partner with Security Operations, Threat Hunting, Incident Response, and Vulnerability Management teams to enrich telemetry, develop hunting queries, and provide adversary context
- Develop scripts and automation using Python or PowerShell to collect, normalize, enrich, correlate, and analyze threat intelligence data
- Map observed attacker behaviors to industry frameworks such as MITRE ATT&CK and the Cyber Kill Chain
- Leverage enterprise-approved AI tools to streamline workflows, automate investigative tasks, and drive continuous improvement
- Evaluate emerging technology trends to inform solution design, threat modeling, and strategic innovation
Requirements
- 3+ years of professional experience in cyber threat intelligence, threat hunting, incident response, security operations, malware analysis, or a related cybersecurity discipline
- 2+ years of experience analyzing security telemetry across SIEM, EDR/XDR, network, DNS, proxy, or cloud security platforms (e.g., Splunk, Microsoft Sentinel, Defender, Crowd Strike)
- 2+ years of experience performing technical investigations of domain/IP infrastructure, certificates, or malware using tools such as Virus Total, passive DNS, or WHOIS/RDAP
- 1 year of demonstrated experience mapping adversary TTPs to framework models such as MITRE ATT&CK or the Cyber Kill Chain
Nice to have:
About the Company
Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The company aims to improve health outcomes by connecting people with the care, pharmacy benefits, data, and resources they need.
