Elite Threat Intelligence Engineer - Remote

UnitedHealth Group; Washington (District of Columbia); On-site; USD 135,000 - 231,000; Full time

Job summary

UnitedHealth Group seeks a Senior Principal Threat Intelligence Engineer to design, deploy, and integrate threat intel capabilities across the security ecosystem. You will build data pipelines, enable automated enrichment in SIEM workflows, and drive automation across CTI, SOC, and Threat Hunting teams.

You will influence tool selection and architecture, work autonomously as needed, and partner with cross-functional teams to accelerate detection, response, and risk mitigation.

Qualifications

• 5+ years in cyber threat intel, cyber security engineering, incident response or malware analysis with strong integration focus.
• Solid coding ability for automation, integration, and data engineering.
• Proficiency in Python and at least one of Java/JS/Go; REST, JSON, and STIX/TAXII experience.
• Familiarity with SIEMs (Splunk, Sentinel, QRadar, Elastic) and SOAR platforms.
• Hands-on with TIPs (MISP, OpenCTI, ThreatConnect, Anomali) and IOC workflows.

Responsibilities

• Deploy and maintain a threat intel platform integrated with security tooling.
• Integrate threat intel into SIEMs for detection and enrichment.
• Develop automated pipelines and detection workflows using AI/LLM capabilities.
• Design playbooks for automated threat response and enrichment across SOC/IR.
• Collaborate on tool selection, architecture, and autonomous delivery within CTI space.

Skills

Python

Java/JavaScript/Go

REST APIs

JSON

STIX/TAXII

CI/CD

Git

Linux

Windows Server

Active Directory

MacOS

Docker

AWS

AI in TI

TIPs

IOC lifecycle

SIEM

SOAR

Threat hunting

Playbooks

Orchestration

Tools

Splunk

Microsoft Sentinel

IBM QRadar

Elastic

MISP

OpenCTI

ThreatConnect

Anomali

Job description

UnitedHealth Group seeks a Senior Principal Threat Intelligence Engineer to design, deploy, and integrate threat intel capabilities across the security ecosystem. You will build data pipelines, enable automated enrichment in SIEM workflows, and drive automation across CTI, SOC, and Threat Hunting teams.

You will influence tool selection and architecture, work autonomously as needed, and partner with cross-functional teams to accelerate detection, response, and risk mitigation.