Enterprise Threat Intelligence Leader

The Principal Information Security Analyst serves as a senior leader within the Cybersecurity Threat Intelligence team and is accountable for advancing the team's capabilities, maturity, and impact. In addition to delivering complex individual work, the role establishes direction, develops repeatable intelligence practices, mentors and influences others, and drives the integration of intelligence into Cyber Defense and enterprise decision-making.

The analyst independently identifies, collects, validates, analyzes, and disseminates intelligence from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources. The role complements the team's cybersecurity expertise by expanding its ability to develop Mayo-specific intelligence rather than relying primarily on externally produced threat reporting.

This position connects cyber, physical, operational, reputational, insider, research, executive, and business risks and translates those connections into decision-relevant intelligence for Cyber Defense and the enterprise.

Primary Responsibilities:

Capability Leadership and Program Maturity

• Set direction for enterprise threat intelligence capabilities and translate strategic priorities into an actionable intelligence roadmap.
• Drive maturity by establishing standards, methods, repeatable workflows, feedback mechanisms, and measures that improve the quality, consistency, timeliness, and operational value of intelligence.
• Lead complex and ambiguous intelligence initiatives requiring coordination across Cyber Defense, security, risk, investigative, technical, and business functions.
• Mentor analysts, share tradecraft, and strengthen team capabilities in structured analysis, OSINT, enterprise intelligence, government engagement, and executive communication.
• Influence priorities without relying on formal authority, identify capability gaps, recommend investments and partnerships, and serve as a senior advisor across the enterprise.

Intelligence Requirements, Collection and Analysis

• Develop and maintain intelligence requirements aligned with Mayo Clinic priorities and the operational needs of Cyber Defense and enterprise stakeholders.
• Identify, collect, validate, and analyze information from government, law-enforcement, industry, commercial, open-source, dark web, and internal sources.
• Produce actionable intelligence concerning threat actors, campaigns, malware, vulnerabilities, tactics, techniques, procedures, and emerging risks.
• Conduct adversary profiling and threat actor research using MITRE ATT&CK and other relevant intelligence frameworks.
• Apply structured analytic techniques, link analysis, metadata analysis, infrastructure analysis, geolocation, and digital-footprint research to complex intelligence questions.
• Develop strategic, operational, and tactical assessments tailored to Mayo Clinic, including threats affecting healthcare delivery, research, executives, personnel, and critical operations.

Intelligence Production and Cyber Defense Enablement

• Produce recurring intelligence reports, threat assessments, executive briefings, investigative products, and time-sensitive operational intelligence.
• Translate intelligence findings into clear implications and recommended actions for Threat Hunting, Detection Engineering, Security Validation, Incident Response, Red Team, and other Cyber Defense functions.
• Develop Mayo-specific intelligence by connecting information from multiple sources, identifying relevant patterns, and converting fragmented information into actionable assessments.
• Support threat actor attribution, campaign tracking, trend analysis, intelligence-led hunting, detection development, validation activities, and complex cyber investigations.
• Assess the operational relevance of commercial and partner-provided intelligence and enrich it with enterprise context.

OSINT and Investigations

• Conduct advanced OSINT investigations using public, commercial, and specialized intelligence resources.
• Research threat activity across the surface web, social media, underground forums, dark web, digital infrastructure, and other relevant environments.
• Investigate cyber-enabled fraud, threats to personnel, insider threats, reputational risks, intellectual-property concerns, cyber-enabled physical threats, and emerging threat activity.
• Develop investigative intelligence that supports Cyber Defense, Security Operations, Enterprise Risk, Executive Protection, Research Security, and other enterprise partners.
• Preserve analytical…