Threat Intelligence Analyst Jobs
Threat Intelligence Analyst jobs are open across defense contractors, financial services, healthcare, and technology, at every level from junior analyst to principal and director, with specializations in malware analysis, threat hunting, and nation-state actor tracking. Find a role that fits from the openings below and apply directly.
Find JobsOverview
Showing 5 of 71+ Threat Intelligence Analyst jobs
Workforce Classification:
HybridJoin Our Team: Do Meaningful Work and Improve People’s Lives
Our purpose, to improve customers’ lives by making healthcare work better, is far from ordinary. And so are our employees. Working at Premera means you have the opportunity to drive real change by transforming healthcare.
Premera is committed to being a workplace where people feel empowered to grow, innovate, and lead with purpose. By investing in our employees and fostering a culture of collaboration and continuous development, we’re able to better serve our customers. It’s this commitment that has earned us recognition as one of the best companies to work for. Learn more about our recent awards and recognitions as a greatest workplace.
Learn how Premera supports our members, customers and the communities that we serve through our Healthsource blog: https://healthsource.premera.com/ .
Cybersecurity Threat Intelligence Engineer II, Att@ck
Join Premera’s Threat Intelligence and Response (TI&R) team as a Cybersecurity Threat Intelligence Engineer II, Att@ck . As part of Premera’s broader Purple Team capabilities, you will apply the MITRE ATT&CK framework and threat intelligence to evaluate the effectiveness of our security defenses through authorized adversary emulation, security testing, and detection validation.
In this role, you will develop and execute controlled testing scenarios that reproduce real-world attacker behaviors, assess security telemetry and detection capabilities, identify defensive gaps, and work closely with the Threat Intelligence and Incident Response teams within TI&R to strengthen Premera’s security posture. You will also help validate corrective actions and develop repeatable testing processes that demonstrate measurable improvements in our ability to detect and respond to relevant threats.
Success in this role requires technical curiosity, sound analytical judgment, strong documentation skills, and the ability to translate complex technical findings into clear, actionable recommendations for both technical and nontechnical stakeholders.
This is a hybrid role, located on our campus in Mountlake Terrace, Washington.
What You’ll Do
- Plan and execute authorized adversary emulation, security testing, and technical assessments aligned with the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.
- Research emerging adversary tactics, techniques, and procedures (TTPs), including those associated with nation-state actors and cybercriminal organizations, and translate relevant threat intelligence into practical, risk-based testing scenarios.
- Reproduce adversary techniques within approved testing environments and established rules of engagement, ensuring activities comply with operational safety, privacy, and security requirements.
- Collect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated attacker activity.
- Collaborate with the Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation effectiveness.
- Develop, maintain, and improve scripts, automation, and repeatable testing procedures to streamline adversary emulation, telemetry collection, security validation, and technical analysis.
- Analyze testing results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement across Premera’s security capabilities.
- Support incident response investigations and other assigned technical assessments by providing expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
- Contribute to security assessments involving significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability assessment, and security control validation concepts.
- Document testing methodologies, findings, limitations, and recommendations, and communicate results through written reports, technical discussions, and briefings appropriate for technical and nontechnical stakeholders.
- Apply applicable security, privacy, regulatory, and organizational requirements when planning and performing assigned technical activities.
- Organize and prioritize assigned work in alignment with team objectives, established procedures, and Purple Team initiatives while demonstrating sound judgment, initiative, and appropriate technical independence. Share technical knowledge, lessons learned, and testing insights across the TI&R department to strengthen collective defensive capabilities.
What You'll Bring
Minimum Qualifications
- Bachelor’s degree in Information Systems or Business Administration or four (4) years’ experience. Three (3) years’ experience designing, implementing, and troubleshooting networked computer systems, including: systems integration, hardware requirements and network design planning; vendor negotiations for hardware and software; which must include: Two (2) years’ experience with secure network and systems architecture, design and implementation, intrusion detection, defense and incident response, security configuration management, access controls design and implementation and security policy and standards development.
Preferred Qualifications
- Industry-recognized offensive cybersecurity or adversary emulation certifications, such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN, GXPN, or eLearnSecurity eJPT/eCPPT.
- Hands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
- Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
- Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.
- Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
- Hands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
- Working knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.
- Familiarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.
- Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST, where relevant.
Premera total rewards
Our comprehensive total rewards package provides support, resources, and opportunities to help employees thrive and grow. Our total rewards are more than a collection of perks, they're a reflection of our commitment to your health and well-being. We offer a broad array of rewards including physical, financial, emotional, and community benefits, including:
Medical, vision, and dental coverage with low employee premiums.
Voluntary benefit offerings, including pet insurance for paw parents.
Life and disability insurance.
Retirement programs, including a 401K employer match and, believe it or not, a pension plan that is vested after 3 years of service.
Wellness incentives with a wide range of mental well-being resources for you and your dependents, including counseling services, stress management programs, and mindfulness programs, just to name a few.
Generous paid time off to reenergize.
Looking for continuing education? We have tuition assistance for both undergraduate and graduate degrees.
Employee recognition program to celebrate anniversaries, team accomplishments, and more.
For our hybrid employees, our on-campus model provides flexibility to create your own routine with access to on-site resources, networking opportunities, and team engagement.
Commuter perks make your trip to work less impactful on the environment and your wallet.
Free convenient on-site parking.
Subsidized on-campus cafes make lunchtime connections with colleagues fun and affordable.
Participate in engaging on-site activities such as health and wellness events, coffee connects, disaster preparedness fairs and more.
Our complementary fitness & well-being center offers both in-person and virtual workouts and nutritional counseling.
Need a brain break? Challenge someone to a game of shuffleboard or ping pong while on campus.
Equal employment opportunity/affirmative action:
Premera is an equal opportunity/affirmative action employer. Premera seeks to attract and retain the most qualified individuals without regard to race, color, religion, sex, national origin, age, disability, marital status, veteran status, gender or gender identity, sexual orientation, genetic information or any other protected characteristic under applicable law.
If you need an accommodation to apply online for positions at Premera, please contact Premera Human Resources via email at careers@premera.com or via phone at 425-918-4785.
The pay for this role will vary based on a range of factors including, but not limited to, a candidate’s geographic location, market conditions, and specific skills and experience.
The salary range for this role is posted below; we generally target up to and around the midpoint of the range.
National Plus Salary Range:
$92,400.00 - $157,100.00*National Plus salary range is used in higher cost of labor markets including Western Washington and Alaska .
We’re happy to discuss compensation further during the interview because we believe that open communication leads to better outcomes for all. We’re committed to creating an environment where all employees are celebrated for their unique skills and contributions.
Workforce Classification:
HybridJoin Our Team: Do Meaningful Work and Improve People’s Lives
Our purpose, to improve customers’ lives by making healthcare work better, is far from ordinary. And so are our employees. Working at Premera means you have the opportunity to drive real change by transforming healthcare.
Premera is committed to being a workplace where people feel empowered to grow, innovate, and lead with purpose. By investing in our employees and fostering a culture of collaboration and continuous development, we’re able to better serve our customers. It’s this commitment that has earned us recognition as one of the best companies to work for. Learn more about our recent awards and recognitions as a greatest workplace.
Learn how Premera supports our members, customers and the communities that we serve through our Healthsource blog: https://healthsource.premera.com/ .
Cybersecurity Threat Intelligence Engineer II, Att@ck
Join Premera’s Threat Intelligence and Response (TI&R) team as a Cybersecurity Threat Intelligence Engineer II, Att@ck . As part of Premera’s broader Purple Team capabilities, you will apply the MITRE ATT&CK framework and threat intelligence to evaluate the effectiveness of our security defenses through authorized adversary emulation, security testing, and detection validation.
In this role, you will develop and execute controlled testing scenarios that reproduce real-world attacker behaviors, assess security telemetry and detection capabilities, identify defensive gaps, and work closely with the Threat Intelligence and Incident Response teams within TI&R to strengthen Premera’s security posture. You will also help validate corrective actions and develop repeatable testing processes that demonstrate measurable improvements in our ability to detect and respond to relevant threats.
Success in this role requires technical curiosity, sound analytical judgment, strong documentation skills, and the ability to translate complex technical findings into clear, actionable recommendations for both technical and nontechnical stakeholders.
This is a hybrid role, located on our campus in Mountlake Terrace, Washington.
What You’ll Do
- Plan and execute authorized adversary emulation, security testing, and technical assessments aligned with the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.
- Research emerging adversary tactics, techniques, and procedures (TTPs), including those associated with nation-state actors and cybercriminal organizations, and translate relevant threat intelligence into practical, risk-based testing scenarios.
- Reproduce adversary techniques within approved testing environments and established rules of engagement, ensuring activities comply with operational safety, privacy, and security requirements.
- Collect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated attacker activity.
- Collaborate with the Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation effectiveness.
- Develop, maintain, and improve scripts, automation, and repeatable testing procedures to streamline adversary emulation, telemetry collection, security validation, and technical analysis.
- Analyze testing results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement across Premera’s security capabilities.
- Support incident response investigations and other assigned technical assessments by providing expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
- Contribute to security assessments involving significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability assessment, and security control validation concepts.
- Document testing methodologies, findings, limitations, and recommendations, and communicate results through written reports, technical discussions, and briefings appropriate for technical and nontechnical stakeholders.
- Apply applicable security, privacy, regulatory, and organizational requirements when planning and performing assigned technical activities.
- Organize and prioritize assigned work in alignment with team objectives, established procedures, and Purple Team initiatives while demonstrating sound judgment, initiative, and appropriate technical independence. Share technical knowledge, lessons learned, and testing insights across the TI&R department to strengthen collective defensive capabilities.
What You'll Bring
Minimum Qualifications
- Bachelor’s degree in Information Systems or Business Administration or four (4) years’ experience. Three (3) years’ experience designing, implementing, and troubleshooting networked computer systems, including: systems integration, hardware requirements and network design planning; vendor negotiations for hardware and software; which must include: Two (2) years’ experience with secure network and systems architecture, design and implementation, intrusion detection, defense and incident response, security configuration management, access controls design and implementation and security policy and standards development.
Preferred Qualifications
- Industry-recognized offensive cybersecurity or adversary emulation certifications, such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN, GXPN, or eLearnSecurity eJPT/eCPPT.
- Hands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.
- Experience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.
- Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.
- Experience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.
- Hands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.
- Working knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.
- Familiarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.
- Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST, where relevant.
Premera total rewards
Our comprehensive total rewards package provides support, resources, and opportunities to help employees thrive and grow. Our total rewards are more than a collection of perks, they're a reflection of our commitment to your health and well-being. We offer a broad array of rewards including physical, financial, emotional, and community benefits, including:
Medical, vision, and dental coverage with low employee premiums.
Voluntary benefit offerings, including pet insurance for paw parents.
Life and disability insurance.
Retirement programs, including a 401K employer match and, believe it or not, a pension plan that is vested after 3 years of service.
Wellness incentives with a wide range of mental well-being resources for you and your dependents, including counseling services, stress management programs, and mindfulness programs, just to name a few.
Generous paid time off to reenergize.
Looking for continuing education? We have tuition assistance for both undergraduate and graduate degrees.
Employee recognition program to celebrate anniversaries, team accomplishments, and more.
For our hybrid employees, our on-campus model provides flexibility to create your own routine with access to on-site resources, networking opportunities, and team engagement.
Commuter perks make your trip to work less impactful on the environment and your wallet.
Free convenient on-site parking.
Subsidized on-campus cafes make lunchtime connections with colleagues fun and affordable.
Participate in engaging on-site activities such as health and wellness events, coffee connects, disaster preparedness fairs and more.
Our complementary fitness & well-being center offers both in-person and virtual workouts and nutritional counseling.
Need a brain break? Challenge someone to a game of shuffleboard or ping pong while on campus.
Equal employment opportunity/affirmative action:
Premera is an equal opportunity/affirmative action employer. Premera seeks to attract and retain the most qualified individuals without regard to race, color, religion, sex, national origin, age, disability, marital status, veteran status, gender or gender identity, sexual orientation, genetic information or any other protected characteristic under applicable law.
If you need an accommodation to apply online for positions at Premera, please contact Premera Human Resources via email at careers@premera.com or via phone at 425-918-4785.
The pay for this role will vary based on a range of factors including, but not limited to, a candidate’s geographic location, market conditions, and specific skills and experience.
The salary range for this role is posted below; we generally target up to and around the midpoint of the range.
National Plus Salary Range:
$92,400.00 - $157,100.00*National Plus salary range is used in higher cost of labor markets including Western Washington and Alaska .
We’re happy to discuss compensation further during the interview because we believe that open communication leads to better outcomes for all. We’re committed to creating an environment where all employees are celebrated for their unique skills and contributions.
Threat Intelligence Analyst Jobs by Experience Level
See All 71 Threat Intelligence Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsThreat Intelligence Analyst Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Cybersecurity
- Accounting & Auditing
What Employers Look For
The qualifications that appear most often in threat intelligence analyst jobs.
- Bachelor's degree in cybersecurity, computer science, information systems, or a related field
- Proficiency with threat intelligence platforms such as Recorded Future, ThreatConnect, or MISP
- Experience applying the MITRE ATT&CK framework to analyze and attribute adversary behavior
- Familiarity with malware analysis, reverse engineering tools, or YARA rule development
- Active or eligibility for a U.S. security clearance, particularly for federal and defense roles
- Industry certifications such as GIAC GCTI, GCFE, or CompTIA CySA+ preferred or required
Tips for Your Threat Intelligence Analyst Job Search
Tailor your resume to threat types
Hiring managers scan for whether you've worked on specific threat categories like APT groups, ransomware campaigns, or insider threats. Name the threat actors and campaigns you've analyzed rather than listing generic security tasks.
Certify before targeting cleared roles
Many defense and federal contractor postings require or prefer a current security clearance alongside certifications like GIAC GREM or GCTI. Clarify your clearance level and certification status in your resume header so screeners don't have to dig.
Apply early to roles that fit
Migrate Mate lists threat intelligence analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Show your intelligence production samples
Analysts who can share sanitized finished intelligence reports, threat briefs, or YARA rules get callbacks faster. Build a portfolio of redacted work product that demonstrates how you structure analysis and communicate findings to non-technical stakeholders.
Match your tool stack to the job description
Postings vary sharply between platforms like Recorded Future, Mandiant Advantage, MISP, and OpenCTI. Skim the tools listed in each posting and lead with the ones you've used in your cover letter and skills section.
Prepare for a structured analytical exercise
Many final-round interviews include a live or take-home exercise where you pivot on an indicator of compromise and present findings. Practice narrating your process aloud, not just arriving at the right answer, since interviewers score your reasoning as much as your conclusion.
Threat Intelligence Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most threat intelligence analysts?
The companies hiring the most threat intelligence analysts right now include Leidos, Microsoft, and Everforth ECS, with the largest share of openings in Virginia, California, and Florida, based on current listings on Migrate Mate as of November 2026. Defense contractors, large financial institutions, and managed security service providers consistently make up the bulk of active hiring.
How many threat intelligence analyst jobs are remote?
About 55% of threat intelligence analyst openings are fully remote or hybrid as of November 2026, though positions requiring a security clearance are almost always on-site or in secure facilities. Strategic intelligence roles focused on open-source research and finished reporting tend to offer the most remote flexibility compared to hands-on malware analysis or incident response-adjacent positions.
How do you become a threat intelligence analyst?
Start by building a foundation in networking, operating systems, and security fundamentals through coursework or entry-level security operations center work. Develop hands-on skills in threat hunting, indicator analysis, and the MITRE ATT&CK framework. Pursue certifications like GIAC GCTI or CompTIA CySA+, build a portfolio of sanitized analysis samples, and target junior analyst or SOC tier-two roles that include an intelligence component to earn your first dedicated posting.
Can you get a threat intelligence analyst job with little experience?
Yes, but you need to compensate with demonstrable analytical output. Contribute to open-source threat intelligence communities, publish blog posts attributing publicly documented campaigns, or complete capture-the-flag competitions with a forensics or threat analysis focus. Many employers will consider candidates from adjacent roles like security operations center analyst or incident responder who can show they've already done intelligence work as part of their day job.
What does the threat intelligence analyst interview process look like?
Most processes run three to four rounds. A recruiter screen covers your background and clearance status, followed by a technical interview where you walk through a past investigation or attribution case. A practical exercise, either take-home or live, asks you to pivot on indicators and present findings. Final rounds often include a panel with senior analysts or a hiring manager focused on how you communicate intelligence to non-technical audiences.
Where can I find and apply to threat intelligence analyst jobs?
You can find and apply to threat intelligence analyst jobs on Migrate Mate, which lists current openings from employers across the United States. Search the listings to find roles that match your experience, clearance level, and specialization, then apply directly to each one that fits.
See All 71 Threat Intelligence Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs