Workforce Classification:
Hybrid
Join Our Team: Do Meaningful Work and Improve People’s Lives
Our purpose, to improve customers’ lives by making healthcare work better, is far from ordinary. And so are our employees. Working at Premera means you have the opportunity to drive real change by transforming healthcare.
Premera is committed to being a workplace where people feel empowered to grow, innovate, and lead with purpose. By investing in our employees and fostering a culture of collaboration and continuous development, we’re able to better serve our customers. It’s this commitment that has earned us recognition as one of the best companies to work for. Learn more about our recent awards and recognitions as a greatest workplace.
Learn how Premera supports our members, customers and the communities that we serve through our Healthsource blog: https://healthsource.premera.com/ .
Cybersecurity Threat Intelligence Engineer II, Att@ck
Join Premera’s Threat Intelligence and Response (TI&R) team as a Cybersecurity Threat Intelligence Engineer II, Att@ck . As part of Premera’s broader Purple Team capabilities, you will apply the MITRE ATT&CK framework and threat intelligence to evaluate the effectiveness of our security defenses through authorized adversary emulation, security testing, and detection validation.
In this role, you will develop and execute controlled testing scenarios that reproduce real-world attacker behaviors, assess security telemetry and detection capabilities, identify defensive gaps, and work closely with the Threat Intelligence and Incident Response teams within TI&R to strengthen Premera’s security posture. You will also help validate corrective actions and develop repeatable testing processes that demonstrate measurable improvements in our ability to detect and respond to relevant threats.
Success in this role requires technical curiosity, sound analytical judgment, strong documentation skills, and the ability to translate complex technical findings into clear, actionable recommendations for both technical and nontechnical stakeholders.
This is a hybrid role, located on our campus in Mountlake Terrace, Washington.
What You’ll Do
Plan and execute authorized adversary emulation, security testing, and technical assessments aligned with the MITRE ATT&CK framework to evaluate defensive controls and identify detection and visibility gaps.
Research emerging adversary tactics, techniques, and procedures (TTPs), including those associated with nation-state actors and cybercriminal organizations, and translate relevant threat intelligence into practical, risk-based testing scenarios.
Reproduce adversary techniques within approved testing environments and established rules of engagement, ensuring activities comply with operational safety, privacy, and security requirements.
Collect, analyze, and document technical evidence and security telemetry generated during testing to determine whether expected defensive controls detected, prevented, or appropriately responded to simulated attacker activity.
Collaborate with the Threat Intelligence and Incident Response teams within TI&R to evaluate findings, recommend defensive improvements, and conduct follow-up testing to validate remediation effectiveness.
Develop, maintain, and improve scripts, automation, and repeatable testing procedures to streamline adversary emulation, telemetry collection, security validation, and technical analysis.
Analyze testing results and identify trends in detection coverage, control effectiveness, and defensive visibility to support continuous improvement across Premera’s security capabilities.
Support incident response investigations and other assigned technical assessments by providing expertise in adversary behavior, attack techniques, security telemetry, and detection capabilities.
Contribute to security assessments involving significant changes to systems, applications, and networks by applying relevant threat intelligence, vulnerability…