Principal Cybersecurity Analyst - Washington

Salary: $112,700 - 193,200 per year Requirements:

• We need at least 3 years of experience in cyber threat intelligence, cybersecurity engineering, incident response, or malware analysis, with strong emphasis on tool and technology integration.
• We need proficiency in Python for automation, API integrations, and data processing, or in Java, JavaScript/Node.js, or Go for service development.
• We expect experience with REST APIs, JSON, STIX/TAXII protocols, data parsing, transformation, pipeline development, and scripting in Bash or PowerShell.
• We need familiarity with version control, especially Git, and CI/CD pipelines.
• We expect hands-on experience across multiple operating systems and platforms, including Linux variants, AWS, Docker, Windows Server, Active Directory, and Mac OS X.
• We need experience using AI in a threat intelligence context, including LLMs, MCP server setup, and RAG-related processes.
• We expect direct experience with threat intelligence platforms such as MISP, OpenCTI, ThreatConnect, or Anomali.
• We need experience integrating multiple intelligence sources and data formats.
• We expect strong working knowledge of SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, or Elastic.
• We need experience developing detection rules, correlation searches, and dashboards.
• We expect a solid understanding of log ingestion, normalization, and enrichment pipelines.
• We need experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, Swimlane, or Tines.
• We expect experience building playbooks and runbooks for automated response.
• We need a strong understanding of structured threat intelligence formats such as STIX and TAXII.
• Preferred qualifications include relevant certifications such as GCTI, GCIA, CISSP, or Splunk certifications.
• Preferred qualifications include experience in large-scale security operations or SOC environments.
• Preferred qualifications include familiarity with MITRE ATT&CK and other intelligence frameworks.
• Preferred qualifications include exposure to data engineering technologies such as Kafka, Spark, or Elasticsearch.
• Preferred qualifications include experience with cloud platforms such as AWS, Azure, or Google Cloud Platform and related security integrations.
• Preferred qualifications include background in threat hunting and detection engineering.

• We deploy, integrate, and maintain a threat intelligence platform connected to our security tooling ecosystem.
• We integrate threat intelligence into SIEM platforms for detection use cases and alert enrichment.
• We use agentic AI, LLMs, and related capabilities to deliver contextualized threat intelligence faster to CTI, SOC, IR, and other SecOps teams.
• We build and deploy technology-enabled workflows for intelligence use cases across SOC, IR, Insider Risk, Fraud, Red Team, Threat Hunting, and other stakeholder groups.
• We develop and maintain SOAR playbooks for automated threat response and enrichment.
• We orchestrate workflows across security tools to reduce manual investigation and response time.
• We build and maintain integrations between commercial, open-source, and ISAC intelligence feeds and our internal security platforms.
• We operationalize threat intelligence platforms such as MISP, OpenCTI, ThreatConnect, Anomali, and similar tools with enterprise security systems.
• We develop pipelines to ingest, normalize, deduplicate, and enrich indicators of compromise and threat data.
• We correlate intelligence with telemetry from SIEM, EDR, NDR, and cloud security tools to improve detection accuracy.
• We enable automated alert enrichment using threat intelligence data within SIEM workflows.

• Agentic AI
• AI
• API
• AWS
• Active Directory
• Azure
• Bash
• CI/CD
• Cloud
• Docker
• ElasticSearch
• Git
• IBM
• JSON
• Java
• JavaScript
• Kafka
• Linux
• MCP
• PowerShell
• Python
• RAG
• REST
• Security
• Spark
• Splunk
• Windows
• NodeJS
• Support
• LLM
• RHEL
• Ubuntu

More:

We are UnitedHealth Groups Enterprise Information Security team, responsible for cybersecurity across the organization and for protecting the sensitive data of our members and providers. We focus on strengthening cyber defenses, improving ransomware resilience, reducing vulnerability risk, and securing systems and data globally. In this Principal Threat Intelligence Engineer role, you will help deliver technical intelligence solutions that accelerate analysis, detection, and response across CTI, SOC, Threat Detection, and Threat Hunting teams. We offer the flexibility to work remotely from anywhere in the U.S., with an in-office requirement of at least four days per week for hires in the Minneapolis or Washington, D.C. area. We also provide a comprehensive benefits package, incentive and recognition programs, equity stock purchase, and 401(k) contribution, with salary ranging from $112,700 to $193,200 annually based on full-time employment, experience, education, certifications, and market factors.

last updated 33 week of 2026