Optum is a global organization that delivers care, aided by technology to help millions of people live healthier lives. The work you do with our team will directly improve health outcomes by connecting people with the care, pharmacy benefits, data and resources they need to feel their best. Here, you will find a culture guided by inclusion, talented peers, comprehensive benefits and career development opportunities. Come make an impact on the communities we serve as you help us advance health optimization on a global scale. Join us to start Caring. Connecting. Growing together.
As a Cyber Threat Intelligence Analyst within the Cyber Defense team at Optum Insight, you will play a pivotal role in building and maturing our Cyber Threat Intelligence program. This remote position offers the unique opportunity to leverage cutting-edge security technologies and enterprise-approved AI tools to proactively hunt for threats across enterprise environments. You will collaborate closely with Cyber Defense and Cyber Assurance teams to deliver tactical, operational, and strategic intelligence that protects healthcare organizations we serve. If you are passionate about tracking adversary behaviors, driving continuous defensive improvements, and working in a highly collaborative, fast-paced environment, we invite you to apply.
Primary Responsibilities:
- Use enterprise-approved AI tools to streamline workflows, automate repetitive tasks, and drive continuous improvement within threat intelligence gathering
- Evaluate emerging trends and technological advancements to inform solution design, threat hunting strategies, and strategic defense innovation
- Collect, aggregate, and analyze cyber threat intelligence from internal and external sources to identify emerging threats, adversary activity, and risks to the organization
- Monitor threat actor tactics, techniques, and procedures (TTPs), malware campaigns, vulnerabilities, and indicators of compromise (IOCs) relevant to the organization's environment
- Produce actionable tactical, operational, and strategic intelligence products tailored to technical teams, cyber leadership, and business stakeholders
- Conduct intelligence-driven structured and unstructured threat hunting activities to proactively identify malicious activity, adversary presence, and indicators of compromise within enterprise environments
- Collaborate closely with the Incident Response team during active security incidents by providing threat context, adversary attribution, attack-path analysis, and recommendations for containment and remediation
- Partner with Detection Engineering teams to translate threat intelligence into effective detection logic, analytics, use cases, signatures, correlation rules, and monitoring content
- Work with Security Engineering teams to identify security control gaps, recommend defensive improvements, and validate mitigation strategies against current threat activity
- Support Security Operations Center (SOC) analysts by providing timely threat intelligence, indicators, adversary context, and investigative guidance to enhance detection and response effectiveness
- Collaborate with Vulnerability Response, Vulnerability Management, and Cyber Assurance teams to assess the exploitation risk of vulnerabilities, prioritize remediation efforts, and provide threat-informed risk assessments
- Develop and maintain threat intelligence repositories, knowledge bases, threat profiles, and intelligence-sharing processes
- Map adversary behaviors to industry frameworks such as MITRE ATT&CK and support the development of threat-informed defense strategies
- Conduct research on emerging cyber threats, geopolitical developments, ransomware groups, nation-state actors, and cybercriminal organizations that may impact the business
- Support purple team, red team, and adversary emulation exercises by providing intelligence on relevant threat actors and attack techniques
- Identify trends, patterns, and intelligence gaps to improve organizational cyber defense capabilities and inform strategic security decisions
- Collaborate with internal and external stakeholders, including Cyber Defense, Incident Response, Detection Engineering, Security Engineering, Vulnerability Response, Risk Management, and executive leadership teams to ensure intelligence is actionable and aligned with business priorities
- Prepare and deliver intelligence briefings, threat assessments, and executive-level reporting to communicate current and emerging cyber risks
- Evaluate the effectiveness of threat intelligence activities and continuously improve intelligence collection, analysis, dissemination, and operationalization processes
- Comply with the terms and conditions of the employment contract, company policies and procedures, and any and all directives (such as, but not limited to, transfer and/or re-assignment to different work locations, change in teams and/or work shifts, policies in regards to flexibility of work benefits and/or work environment, alternative work arrangements, and other decisions that may arise due to the changing business environment). The Company may adopt, vary or rescind these policies and directives in its absolute discretion and without any limitation (implied or otherwise) on its ability to do so
Required Qualifications:
- Undergraduate degree or equivalent experience
- 3+ years of experience working in cybersecurity defense, incident response, or threat intelligence operations
- 1+ years of experience conducting structured and/or unstructured threat hunting activities and mapping adversary behaviors to cybersecurity frameworks such as MITRE ATT&CK
- Experience writing tactical and operational threat intelligence briefs or detailed analytical reports
- Experience utilizing scripting languages (such as Python, PowerShell, or Bash) to automate daily operational tasks or parse security data
Preferred Qualifications:
- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field (or equivalent work experience in lieu of degree)
- Professional certifications in threat intelligence or incident response (e.g., GCTI, GCIH, CEH, Security+, CISSP, or equivalent)
- Experience utilizing enterprise-approved AI or automation tools to augment data collection, summarize complex threat reports, and streamline analytical processes
- Deep understanding of threat actor methodologies, cybercriminal ecosystems, ransomware networks, and geopolitical threat vectors
- Demonstrated solid cross-functional collaboration
At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone-of every race, gender, sexuality, age, location and income-deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.
Optum is a drug-free workplace. © 2026 Optum Global Solutions (Philippines) Inc. All rights reserved.