{"id":3557512,"url":"https://alion.io/job/premera-cybersecurity-threat-intelligence-engineer-ii-attck","title":"Cybersecurity Threat Intelligence Engineer II - Att@ck","company":{"id":18095,"name":"Premera","domain":"premera.com","url":"https://alion.io/company/premera","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":47,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mountlake Terrace, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":92400,"max":157100,"currency":"USD","period":"year","gross":null,"usd_annual":157100},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"Bash","optional":true},{"name":"Linux","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"SIEM","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-10-30T00:00:00Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-03T20:47:16Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Workforce Classification:\nHybridJoin Our Team: Do Meaningful Work and Improve People’s Lives\nOur purpose, to improve customers’ lives by making healthcare work better, is far from ordinary. And so are our employees. Working at Premera means you have the opportunity to drive real change by transforming healthcare.\nPremera is committed to being a workplace where people feel empowered to grow, innovate, and lead with purpose. By investing in our employees and fostering a culture of collaboration and continuous development, we’re able to better serve our customers. It’s this commitment that has earned us recognition as one of the best companies to work for. Learn more about our recent awards and recognitions as a greatest workplace.\nLearn how Premera supports our members, customers and the communities that we serve through our Healthsource blog: https://healthsource.premera.com/.\nCybersecurity Threat Intelligence Engineer II, Att@ck\nJoin Premera’s Threat Intelligence and Response (TI&R) team as a Cybersecurity Threat Intelligence Engineer II, Att@ck. As part of Premera’s broader Purple Team capabilities, you will apply the MITRE ATT&CK framework and threat intelligence to evaluate the effectiveness of our security defenses through authorized adversary emulation, security testing, and detection validation.\nIn this role, you will develop and execute controlled testing scenarios that reproduce real-world attacker behaviors, assess security telemetry and detection capabilities, identify defensive gaps, and work closely with the Threat Intelligence and Incident Response teams within TI&R to strengthen Premera’s security posture. You will also help validate corrective actions and develop repeatable testing processes that demonstrate measurable improvements in our ability to detect and respond to relevant threats.\nSuccess in this role requires technical curiosity, sound analytical judgment, strong documentation skills, and the ability to translate complex technical findings into clear, actionable recommendations for both technical and nontechnical stakeholders.\nThis is a hybrid role, located on our campus in Mountlake Terrace, Washington.\nWhat You’ll Do\nPlan and execute authorized adversary emulation, security testing, and technical assessments aligned with the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.\n Research emerging adversary tactics, techniques, and procedures (TTPs), including those associated with nation-state actors and cybercriminal organizations, and translate relevant threat intelligence into practical, risk-based testing scenarios.\nReproduce adversary techniques within approved testing environments and established rules of engagement, ensuring activities comply with operational safety, privacy, and security requirements.\nCollect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated attacker activity.\nCollaborate with the Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation effectiveness.\nDevelop, maintain, and improve scripts, automation, and repeatable testing procedures to streamline adversary emulation, telemetry collection, security validation, and technical analysis.\nAnalyze testing results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement across Premera’s security capabilities.\nSupport incident response investigations and other assigned technical assessments by providing expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.\nContribute to security assessments involving significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability assessment, and security control validation concepts.\nDocument testing methodologies, findings, limitations, and recommendations, and communicate results through written reports, technical discussions, and briefings appropriate for technical and nontechnical stakeholders.\nApply applicable security, privacy, regulatory, and organizational requirements when planning and performing assigned technical activities.\nOrganize and prioritize assigned work in alignment with team objectives, established procedures, and Purple Team initiatives while demonstrating sound judgment, initiative, and appropriate technical independence.\nShare technical knowledge, lessons learned, and testing insights across the TI&R department to strengthen collective defensive capabilities.\nWhat You'll Bring\nMinimum Qualifications\nBachelor’s degree in Information Systems or Business Administration or four (4) years’ experience.\nThree (3) years’ experience designing, implementing, and troubleshooting networked computer systems, including: systems integration, hardware requirements and network design planning; vendor negotiations for hardware and software; which must include: Two (2) years’ experience with secure network and systems architecture, design and implementation, intrusion detection, defense and incident response, security configuration management, access controls design and implementation and security policy and standards development.\n\nPreferred Qualifications\nIndustry-recognized offensive cybersecurity or adversary emulation certifications, such as OffSec OSCP, Zero-Point Security CRTO, GIAC GPEN, GXPN, or eLearnSecurity eJPT/eCPPT.\nHands-on proficiency with the MITRE ATT&CK framework, including mapping adversary TTPs to internal security controls, logging sources, and detection capabilities.\nExperience with adversary emulation, breach and attack simulation (BAS), Purple Team exercises, or structured security control validation methodologies.\n Practical scripting and automation experience using Python, PowerShell, Bash, or similar languages.\nExperience developing repeatable security testing scenarios, analyzing results, and conducting follow-up validation of defensive improvements.\nHands-on experience with security technologies across endpoint detection and response (EDR), network security monitoring, SIEM, identity, and cloud environments.\nWorking knowledge of Windows and Linux operating systems, authentication technologies, networking protocols, and common attacker behaviors.\nFamiliarity with threat intelligence analysis, threat hunting methodologies, and translating intelligence into actionable defensive testing scenarios.\n Familiarity with security control frameworks and regulatory requirements applicable to healthcare environments, including HITRUST, where relevant.\nPremera total rewards\nOur comprehensive total rewards package provides support, resources, and opportunities to help employees thrive and grow. Our total rewards are more than a collection of perks, they're a reflection of our commitment to your health and well-being. We offer a broad array of rewards including physical, financial, emotional, and community benefits, including:\nMedical, vision, and dental coverage with low employee premiums.\n\nVoluntary benefit offerings, including pet insurance for paw parents.\n\nLife and disability insurance.\n\nRetirement programs, including a 401K employer match and, believe it or not, a pension plan that is vested after 3 years of service.\n\nWellness incentives with a wide range of mental well-being resources for you and your dependents, including counseling services, stress management programs, and mindfulness programs, just to name a few.\n\nGenerous paid time off to reenergize.\n\nLooking for continuing education? We have tuition assistance for both undergraduate and graduate degrees.\n\nEmployee recognition program to celebrate anniversaries, team accomplishments, and more.\n\nFor our hybrid employees, our on-campus model provides flexibility to create your own routine with access to on-site resources, networking opportunities, and team engagement.\nCommuter perks make your trip to work less impactful on the environment and your wallet.\n\nFree convenient on-site parking.\n\nSubsidized on-campus cafes make lunchtime connections with colleagues fun and affordable.\n\nParticipate in engaging on-site activities such as health and wellness events, coffee connects, disaster preparedness fairs and more.\n\nOur complementary fitness & well-being center offers both in-person and virtual workouts and nutritional counseling.\n\nNeed a brain break? Challenge someone to a game of shuffleboard or ping pong while on campus.\n\nEqual employment opportunity/affirmativeaction:\nPremera is an equal opportunity/affirmativeaction employer. Premera seeks to attract and retain the most qualified individuals without regard to race, color, religion, sex, national origin, age, disability, marital status, veteran status, gender or gender identity, sexual orientation, genetic information or any other protected characteristic under applicable law.\nIf you need an accommodation to apply online for positions at Premera, please contact Premera Human Resources via email at  or via phone at 425-918-4785.\nThe pay for this role will vary based on a range of factors including, but not limited to, a candidate’s geographic location, market conditions, and specific skills and experience.\nThe salary range for this role is posted below; we generally target up to and around the midpoint of the range.\n National Plus Salary Range:\n$92,400.00 - $157,100.00*National Plus salary range is used in higher cost of labor markets including Western Washington and Alaska.\nWe’re happy to discuss compensation further during the interview because we believe that open communication leads to better outcomes for all. We’re committed to creating an environment where all employees are celebrated for their unique skills and contributions.","description_format":"text","description_chars":9956,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Threat Intelligence","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-31T01:44:56Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":47,"reasons":["conf:6","velocity","win:early"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":157100,"is_top_pay":true},"html_url":"https://alion.io/job/premera-cybersecurity-threat-intelligence-engineer-ii-attck","json_url":"https://alion.io/job/premera-cybersecurity-threat-intelligence-engineer-ii-attck.json","meta":{"generated_at":"2026-11-04T03:32:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5477,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":18095},"rest":"https://alion.io/mcp/rest/get_company?id=18095"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpremera-cybersecurity-threat-intelligence-engineer-ii-attck"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpremera-cybersecurity-threat-intelligence-engineer-ii-attck"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpremera-cybersecurity-threat-intelligence-engineer-ii-attck"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/premera-cybersecurity-threat-intelligence-engineer-ii-attck\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpremera-cybersecurity-threat-intelligence-engineer-ii-attck"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3557512}},{"tool":"search_jobs","arguments":{"company":"premera.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3557512},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}