Senior Principal Security Engineer IS, Cyber Threat Intelligence

Senior Principal Security Engineer IS, Cyber Threat Intelligence

Join our team at Enterprise Information Services and thrive in a culture of patient‑focused, whole‑person care built on understanding, commitment, and mutual respect. Your voice matters here because we empower our staff to inspire and retain the best people.

Providence Health seeks a Senior Principal Security Engineer with threat hunting and cyber‑threat intelligence experience. You will play a crucial role on the Cyber Threat Intelligence (CTI) team and in our cybersecurity strategy, leveraging deep threat hunting expertise to lead CTI’s efforts in tracking, identifying, analyzing, and mitigating emerging threats targeting our healthcare infrastructure. You will also articulate the threat landscape to senior leadership and support Providence’s Threat Detection and Response operations, informing risk and executive decision‑making.

Hybrid work is available for candidates living within a 65‑mile commute of any primary office location listed below.

• Washington:
  Seattle, Redmond, Renton, Vancouver
• California:
  Los Angeles, Irvine
• Oregon:
  Portland

• This is a hybrid role, involving a combination of in‑office and remote work each week.
• Weekly schedule will be determined by the manager based on departmental needs.

• Lead advanced threat hunting initiatives, developing frameworks and methodologies for the team’s hunting and detection efforts.
• Foster a culture of learning and development within the team by sharing threat hunting expertise.
• Communicate and document hunting methodologies and findings, present insights to technical and non‑technical stakeholders, including executives.
• Classify, categorize, and analyze malware and threats; translate into actionable detections using frameworks such as MITRE ATT CK.
• Monitor and assess the healthcare industry threat landscape: adversaries, targets, malware, TTPs, emerging threats, and trends.
• Perform root cause analysis and provide recommendations for proactive measures to prevent cyber intrusions.
• Collaborate with internal teams to provide timely and actionable intelligence aligned with operational needs for CTI, CIRT, Attack Surface Management, and other initiatives.
• Develop and maintain threat profiles with tactical intelligence to enhance detection engineering and hunting operations.
• Monitor emerging technologies such as AI and machine learning to augment threat detection, triage, and analysis.
• Continuously update and refine threat intelligence processes and methodologies to keep the organization at the forefront of cyber defense.
• Stay informed about the latest trends, tools, and techniques in the field and incorporate best practices into daily operations.

• Bachelor’s Degree in Computer Engineering, Computer Science, Mathematics, Engineering—or equivalent education and experience.
• Upon hire: CISSP, CISM, CEH, or equivalent.
• 10 or more years of related experience.
• Experience performing in an Incident Commander role for cyber incidents affecting business operations.
• In‑depth experience designing security controls and countermeasures for operating systems, databases, applications, web services, user devices, and wireless networks.

• Master’s Degree in a relevant field.
• Experience in a Healthcare environment.
• At least 10 years of dedicated threat hunting experience.
• Minimum 5 years at the Principal or Senior Principal level, or equivalent.
• Strong malware sandbox analysis experience and OIC/TTP log analysis to uncover threats and implement detections.
• Strong threat intelligence communication skills for senior leadership, tailoring information to both technical and non‑technical audiences.
• Experience in knowledge sharing to foster a culture of professional skill development.
• Experience conducting in‑depth analysis of cyber threats, including threat actor motivations, intent, and TTPs.
• Proficiency with Crowd Strike query language or Python/other programming languages.
• Deep understanding of threat intelligence, incident response, and threat hunting frameworks, methodologies, and approaches.
• Demonstrated experience applying frameworks such as…