Principal Cyber Security Analyst

Tegria is seeking a Principal Cyber Security Analyst to protect healthcare and claims environments containing sensitive health, personal, and payment data. The role leads threat detection, incident response, risk assessment, and security architecture reviews while partnering across teams to meet regulatory obligations and mentoring security analysts.

Responsibilities:

• Lead investigation and response for complex security incidents, including ransomware, business email compromise, insider threats, and suspected PHI breaches
• Develop and tune detection use cases, correlation rules, and playbooks in SIEM, EDR, and SOAR platforms
• Conduct threat hunting and threat intelligence analysis, with emphasis on healthcare-targeted threat actors
• Direct breach assessment and coordinate notification activities with Privacy, Legal, and Compliance under HIPAA and state breach laws
• Perform post-incident reviews and drive remediation of root causes
• Perform and oversee security risk assessments aligned to HIPAA Security Rule, HITRUST CSF, NIST CSF, NIST 800-53, and SOC 2
• Support internal and external audits, client security questionnaires, and payer/provider due diligence
• Assess third-party and vendor risk, including clearinghouses, TPAs, cloud providers, and business associates
• Maintain risk registers and report risk posture to senior leadership
• Review architecture and design for claims adjudication, EDI (837/835), eligibility, provider portals, and member-facing applications
• Advise on cloud security (AWS, Azure, or GCP), identity and access management, encryption, network segmentation, and data loss prevention
• Embed security into the SDLC, including threat modeling, secure code review, and vulnerability management
• Ensure appropriate controls for data in transit and at rest, including HL7, FHIR, and API-based data exchange
• Safeguard claims data against fraud, unauthorized access, and exfiltration
• Monitor privileged and role-based access to claims platforms, data warehouses, and analytics environments
• Collaborate with Privacy and Compliance on minimum-necessary access, data retention, and de-identification practices
• Serve as technical lead and escalation point for Tier 2 and Tier 3 analysts
• Mentor junior and mid-level staff and contribute to training and tabletop exercises
• Communicate complex technical risks clearly to executive and non-technical stakeholders

Requirements:

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or equivalent experience
• 8+ years of progressive information security experience, including 3+ years in healthcare, health insurance, or claims processing
• Hands-on experience with SIEM (Splunk, Sentinel, QRadar), EDR (CrowdStrike, Defender, SentinelOne), and vulnerability management tools
• Deep knowledge of HIPAA/HITECH, PHI handling requirements, and breach response obligations
• Demonstrated experience leading incident response in a regulated environment
• Working knowledge of cloud security, IAM, network security, and encryption
• Familiarity with healthcare data standards and workflows (EDI X12, HL7, FHIR) and claims lifecycle processes
• Strong written and verbal communication skills
• Analytical and investigative rigor under pressure
• Risk-based decision making and sound judgment
• Cross-functional collaboration and influence without authority
• Ethical handling of sensitive and confidential information
• Continuous learning in a rapidly evolving threat landscape
• Certifications: CISSP, CISM, CCSP, GCIH, GCIA, GCFA, HCISPP, or CISA
• Experience with HITRUST, SOC 2, or PCI DSS assessments
• Experience with payer, TPA, PBM, or healthcare clearinghouse environments
• Familiarity with MITRE ATT&CK, Zero Trust, and scripting for automation (Python, PowerShell)
• Knowledge of healthcare fraud, waste, and abuse (FWA) patterns and related data analytics
• Experience with medical device or IoMT security