Principal Information Security Analyst

The Principal Information Security Analyst serves as a senior leader within the Cybersecurity Threat Intelligence team and is accountable for advancing the team's capabilities, maturity, and impact. In addition to delivering complex individual work, the role establishes direction, develops repeatable intelligence practices, mentors and influences others, and drives the integration of intelligence into Cyber Defense and enterprise decision-making.

The analyst independently identifies, collects, validates, analyzes, and disseminates intelligence from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources. The role complements the team's cybersecurity expertise by expanding its ability to develop Mayo-specific intelligence rather than relying primarily on externally produced threat reporting.

This position connects cyber, physical, operational, reputational, insider, research, executive, and business risks and translates those connections into decision-relevant intelligence for Cyber Defense and the enterprise.

Primary Responsibilities:

Capability Leadership and Program Maturity

• Set direction for enterprise threat intelligence capabilities and translate strategic priorities into an actionable intelligence roadmap.
• Drive maturity by establishing standards, methods, repeatable workflows, feedback mechanisms, and measures that improve the quality, consistency, timeliness, and operational value of intelligence.
• Lead complex and ambiguous intelligence initiatives requiring coordination across Cyber Defense, security, risk, investigative, technical, and business functions.
• Mentor analysts, share tradecraft, and strengthen team capabilities in structured analysis, OSINT, enterprise intelligence, government engagement, and executive communication.
• Influence priorities without relying on formal authority, identify capability gaps, recommend investments and partnerships, and serve as a senior advisor across the enterprise.

Intelligence Requirements, Collection and Analysis

• Develop and maintain intelligence requirements aligned with Mayo Clinic priorities and the operational needs of Cyber Defense and enterprise stakeholders.
• Identify, collect, validate, and analyze information from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources.
• Produce actionable intelligence concerning threat actors, campaigns, malware, vulnerabilities, tactics, techniques, procedures, and emerging risks.
• Conduct adversary profiling and threat actor research using MITRE ATT&CK and other relevant intelligence frameworks.
• Apply structured analytic techniques, link analysis, metadata analysis, infrastructure analysis, geolocation, and digital-footprint research to complex intelligence questions.
• Develop strategic, operational, and tactical assessments tailored to Mayo Clinic, including threats affecting healthcare delivery, research, executives, personnel, and critical operations.

Intelligence Production and Cyber Defense Enablement

• Produce recurring intelligence reports, threat assessments, executive briefings, investigative products, and time-sensitive operational intelligence.
• Translate intelligence findings into clear implications and recommended actions for Threat Hunting, Detection Engineering, Security Validation, Incident Response, Red Team, and other Cyber Defense functions.
• Develop Mayo-specific intelligence by connecting information from multiple sources, identifying relevant patterns, and converting fragmented information into actionable assessments.
• Support threat actor attribution, campaign tracking, trend analysis, intelligence-led hunting, detection development, validation activities, and complex cyber investigations.
• Assess the operational relevance of commercial and partner-provided intelligence and enrich it with enterprise context.

OSINT and Investigations

• Conduct advanced OSINT investigations using public, commercial, and specialized intelligence resources.
• Research threat activity across the surface web, social media, underground forums, dark web, digital infrastructure, and other relevant environments.
• Investigate cyber-enabled fraud, threats to personnel, insider threats, reputational risks, intellectual-property concerns, cyber-enabled physical threats, and emerging threat activity.
• Develop investigative intelligence that supports Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, and other enterprise partners.
• Preserve analytical objectivity, source integrity, and appropriate handling practices when collecting and disseminating sensitive intelligence.

Government, Law-Enforcement, and Industry Engagement

• Establish, maintain, and leverage trusted relationships with federal, state, and local government, law-enforcement, intelligence, healthcare-sector, and information-sharing partners to improve Mayo Clinic's access to relevant threat information and collaborative expertise.
• Represent Cybersecurity Threat Intelligence in intelligence exchanges, working groups, briefings, and partner engagements.
• Coordinate intelligence activities with government agencies, law enforcement, industry partners, information-sharing organizations, and external intelligence providers.
• Facilitate timely two-way intelligence sharing during significant cyber incidents, investigations, or threat events.
• Translate externally sourced intelligence into Mayo Clinic-specific risk context and operational actions.

Enterprise Intelligence Integration

• Identify intersections among cyber, operational, physical, reputational, executive, research, and business risks and translate them into intelligence relevant to enterprise stakeholders.
• Build effective working relationships across Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, Legal, Compliance, and other business and security functions to coordinate intelligence collection, analysis, and dissemination.
• Improve awareness of intelligence activities occurring across Mayo Clinic, identify opportunities for collaboration, and reduce unnecessary duplication of effort.
• Communicate intelligence fluidly to technical, operational, executive, and nontechnical audiences.
• Support leadership through decision-relevant intelligence briefings and risk assessments and serve as a trusted advisor on emerging threats and security trends.

This vacancy is not eligible for sponsorship/ we will not sponsor or transfer visas for this position. Also, Mayo Clinic DOES NOT participate in the F-1 STEM OPT extension program.

Bachelor’s degree in applicable field plus eight (8) years of relevant experience.

Pertinent fields of study and experience include, but are not limited to, information security, computer science, information systems, risk management, or a related field.

OR

Master’s degree in applicable field plus five (5) years of relevant experience. Pertinent fields of study and experience include, but are not limited to, information security, computer science, information systems, risk management, or a related field.

One or more of the following certifications (or equivalent) are required at time of hire: CISSP, CISM, GSEC, OSCP.