Attack Surface Management Security Architect - Remote or Hybrid in MN or DC

Optum Tech is a global leader in health care innovation. Our teams develop cutting-edge solutions that help people live healthier lives and help make the health system work better for everyone. From advanced data analytics and AI to cybersecurity, we use innovative approaches to solve some of health care's most complex challenges. Your contributions here have the potential to change lives. Ready to build the next breakthrough? Join us to start Caring. Connecting. Growing together.

The Security Architectserves as a technical security authority supportingmergers and acquisitions (M&A) security implementation programs. This role is responsible for defining, influencing, and implementingsecurity architectures and controls that are being developed to be included within Optum's current security portfolio, while ensuring integrations are executed securely, efficiently, and in alignment with enterprise risk tolerance.

The Security Architect serves as a senior technical authority responsible for defining, enabling, and governing the organization's Attack Surface Management (ASM) strategy and capabilities. This role focuses on identifying, monitoring, and reducing external security exposure across internet-facing infrastructure, email systems, SaaS platforms, and the dark web. Operating at the intersection of security architecture, threat intelligence, infrastructure, and operations, the Security Architect translates external risk signals into actionable architectures, standards, and remediation strategies. The role partners closely with Enterprise Security, SOC, Threat Intelligence, Infrastructure, Email, Cloud, Application, and Product teams to ensure attack surface visibility is comprehensive, risks are prioritized effectively, and security controls are implemented in alignment with enterprise risk tolerance. Success in this role requires strong architectural judgment, the ability to lead through influence without direct authority, and comfort operating in environments with incomplete or rapidly evolving information.

You'll enjoy the flexibility to work remotely * from anywhere within the U.S. as you take on some tough challenges. For all hires in the Minneapolis or Washington, D.C. area, you will be required to work in the office a minimum of four days per week.

Key Accountabilities:

• Serve as the architectural owner for Attack Surface Management, accountable for strategy, tooling, architecture, and risk alignment
• Lead the design and enablement of dark web monitoring capabilities to identify credential leakage, data exposure, brand abuse, and emerging external threats
• Architect and oversee SMTP and email security integrations, including migration and enablement using Proofpoint
• Enable and govern external vulnerability and exposure scanning, leveraging tools such as Shodan, Xpanse, and Tenable
• Define architectural patterns for discovering, classifying, and correlating external assets across infrastructure, cloud, SaaS, and third-party services
• Partner with SOC and Threat Intelligence teams to operationalize ASM findings into detection, alerting, and response workflows
• Translate external exposure data into risk-based insights for technical and executive stakeholders
• Act as a trusted advisor to business and technology leaders by clearly articulating external risk, architectural trade-offs, and remediation options
• Drive alignment across multiple teams with competing priorities using influence rather than authority
• Leverage enterprise-approved AI tools to enhance productivity and innovation by streamlining workflows and automating repetitive tasks.
• Evaluate emerging trends to drive continuous improvement and strategic innovation

Core Responsibilities:

• Own and evolve security architecture standards and reference designs related to:
  • Attack Surface Management (ASM / EASM)
  • External asset discovery and inventory
  • Email and messaging security (SMTP, gateways, SaaS email platforms)
  • Internet-facing network, cloud, and application exposure
• Define integration patterns between ASM tooling and:
  • SIEM and SOAR platforms
  • Ticketing and remediation workflows
  • Identity and access management systems
• Evaluate and document external security risks, assumptions, dependencies, and constraints
• Produce high-quality internal artifacts including:
  • Security architecture diagrams and reference architectures
  • External exposure and capability gap assessments
  • Roadmap input and architectural recommendations
• Ensure attack surface findings are:
  • Risk-ranked based on exploitability and business impact
  • Mapped to accountable owners
  • Tracked through remediation or accepted risk
• Promote automation where possible to reduce manual effort and accelerate exposure detection and response

• Provide architectural oversight during implementation to ensure security intent is preserved

You'll be rewarded and recognized for your performance in an environment that will challenge you and give you clear direction on what it takes to succeed in your role as well as provide development for other roles you may be interested in.

Required Qualifications:

• 8+ years of experience in security architecture, enterprise security, or platform security roles
• Demonstrated experience designing or overseeing Attack Surface Management or external exposure programs
• Solid understanding of:
  • Internet-facing infrastructure and cloud services
  • DNS, SMTP, TLS certificates, and SaaS exposure
  • Threat actor reconnaissance and exploitation techniques
• Experience enabling or governing:
  • Dark web monitoring and threat intelligence capabilities
  • Email security platforms, including Proofpoint
  • External vulnerability and exposure scanning tools
• Proven ability to operate in ambiguous environments where requirements or solutions are not fully defined
• Exceptional ability to communicate complex security concepts to both technical and non-technical audiences
• Proven track record of leading through influence across organizational boundaries

Preferred Qualifications:

• Experience in healthcare or other highly regulated industries
• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience
• Hands-on or architectural experience with the following tools:
  • Proofpoint
  • Shodan
  • Xpanse
  • Tenable (including external attack surface modules)
  • Splunk or similar SIEM platforms
• Prior experience influencing enterprise security platforms or shared services
• Familiarity with regulatory and compliance frameworks (e.g., HIPAA, NIST, ISO, SOC)
• Experience working with executive stakeholders on risk visibility and prioritization
• Mentorship or thought leadership experience within security or architecture communities

Behavioral Expectations:

• Thinks strategically while remaining pragmatic and delivery-focused
• Proactively identifies risk before exploitation occurs
• Comfortable challenging assumptions and advocating for long-term security outcomes
• Operates with a solid sense of ownership and accountability
• Demonstrates intellectual curiosity and continuous learning
• Acts as a connector across teams, translating technical signals into business-relevant outcomes
  

*All employees working remotely will be required to adhere to UnitedHealth Group's Telecommuter Policy.

Pay is based on several factors including but not limited to local labor markets, education, work experience, certifications, etc. In addition to your salary, we offer benefits such as, a comprehensive benefits package, incentive and recognition programs, equity stock purchase and 401k contribution (all benefits are subject to eligibility requirements). No matter where or when you begin a career with us, you'll find a far-reaching choice of benefits and incentives. The salary for this role will range from $112,700 to $193,200 annually based on full-time employment. We comply with all minimum wage laws as applicable.

Application Deadline: This will be posted for a minimum of 2 business days or until a sufficient candidate pool has been collected. Job posting may come down early due to volume of applicants.

At UnitedHealth Group, our mission is to help people live healthier lives and make the health system work better for everyone. We believe everyone-of every race, gender, sexuality, age, location and income-deserves the opportunity to live their healthiest life. Today, however, there are still far too many barriers to good health which are disproportionately experienced by people of color, historically marginalized groups and those with lower incomes. We are committed to mitigating our impact on the environment and enabling and delivering equitable care that addresses health disparities and improves health outcomes - an enterprise priority reflected in our mission.

UnitedHealth Group is an Equal Employment Opportunity employer under applicable law and qualified applicants will receive consideration for employment without regard to race, national origin, religion, age, color, sex, sexual orientation, gender identity, disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations.

UnitedHealth Group is a drug - free workplace. Candidates are required to pass a drug test before beginning employment.