Remote Cyber Threat Intelligence Analyst

UnitedHealth-Grou; Eden Prairie (MN); Remote; USD 73,000 - 130,000; Full time

Job summary

UnitedHealth Group is seeking a Cybersecurity Analyst to monitor threats, analyze TTPs, and translate findings into actionable intelligence for Threat Hunting, SOC, and Incident Response. Remote work within the United States is supported, with collaboration across Enterprise Information Security.

The role emphasizes Python/PowerShell automation, MITRE ATT&CK mapping, and leveraging AI tools to enhance threat detection and response capabilities.

Qualifications

• 3+ years of professional experience in cyber threat intelligence, threat hunting, incident response, security operations, malware analysis, or a related cybersecurity discipline.
• 2+ years of experience analyzing security telemetry across SIEM, EDR/XDR, network, DNS, proxy, or cloud security platforms (e.g., Splunk, Microsoft Sentinel, Defender, CrowdStrike).
• 2+ years of experience performing technical investigations of domain/IP infrastructure, certificates, or malware using tools such as VirusTotal, passive DNS, or WHOIS/RDAP.
• 1 year of demonstrated experience mapping adversary TTPs to framework models such as MITRE ATT&CK or the Cyber Kill Chain.

Responsibilities

• Monitor and analyze emerging cyber threats, threat actor tactics, techniques, and procedures (TTPs), third-party incidents, and vulnerabilities relevant to the organization.
• Evaluate intelligence sources and distinguish reliable technical evidence from unverified reporting or low-confidence attribution.
• Perform technical analysis of malicious infrastructure, IP addresses, domains, URLs, certificates, and email artifacts using passive DNS, WHOIS/RDAP, and internet scanning data.
• Analyze malware and suspicious files using static/dynamic analysis techniques, sandbox environments, and reverse-engineering tools as appropriate.
• Produce clear technical intelligence reports, briefings, and profiles detailing adversary capabilities, confidence levels, and recommended defensive actions.
• Partner with Security Operations, Threat Hunting, Incident Response, and Vulnerability Management teams to enrich telemetry, develop hunting queries, and provide adversary context.
• Develop scripts and automation using Python or PowerShell to collect, normalize, enrich, correlate, and analyze threat intelligence data.
• Map observed attacker behaviors to industry frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
• Leverage enterprise-approved AI tools to streamline workflows, automate investigative tasks, and drive continuous improvement.
• Evaluate emerging technology trends to inform solution design, threat modeling, and strategic innovation.

Skills

Threat intelligence

Threat hunting

Incident response

Security operations

Malware analysis

Python

PowerShell

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Splunk

Microsoft Sentinel

Defender

CrowdStrike

Job description

UnitedHealth Group is seeking a Cybersecurity Analyst to monitor threats, analyze TTPs, and translate findings into actionable intelligence for Threat Hunting, SOC, and Incident Response. Remote work within the United States is supported, with collaboration across Enterprise Information Security.

The role emphasizes Python/PowerShell automation, MITRE ATT&CK mapping, and leveraging AI tools to enhance threat detection and response capabilities.