Insider Threat Engineer

Responsibilities Lead Insider Threat Digital Investigations Conduct comprehensive technical investigations individually and partnering with incident response teams into potential insider threat incidents, including data exfiltration, intellectual property theft, unauthorized access, and other malicious activities Collect, preserve, and analyze digital evidence from a variety of sources (endpoints, network logs, cloud services, email, etc.) Document all investigative steps and findings in a clear, concise, and defensible manner Present findings to senior leadership and cross‑functional partners (Legal, HR, Privacy) in a professional and objective manner Ensure regulatory, legal and privacy requirements are met throughout investigations Insider Threat Hunting: proactively hunt for insider threats using security tools and data sources (SIEM, DLP, EDR, UEBA) Develop and execute threat hunting hypotheses based on emerging threats, attack techniques, and an understanding of the company's unique environment Correlate disparate data points to identify anomalous or suspicious user behaviors Detection & Response Improvement: collaborate with SIRT and Threat Detection teams to enhance insider threat detection capabilities Design, develop, and implement new rules, alerts, and use cases in security tools to identify insider threat indicators Evaluate and recommend new technologies and processes to mature the Insider Threat program Develop and refine response playbooks for various insider threat scenarios Cross‑Functional Collaboration: serve as the primary technical liaison for the Insider Threat program, building strong, trusted relationships with Legal, HR, and Privacy teams Work in lockstep with these teams to ensure investigations are conducted with sensitivity, respect for employee privacy, and within legal and ethical guidelines Provide technical expertise and guidance during policy development and incident response planning Requirements 5+ years of experience in a technical security role, with at least 2+ years focused on insider threat, digital forensics, or security investigations Proven experience in conducting and leading complex technical investigations, including the use of forensic tools (e.g., EnCase, FTK, X-Ways, or open-source alternatives) Deep understanding of security technologies such as SIEM (e.g., Splunk, Elastic), EDR (e.g., CrowdStrike, SentinelOne), and UEBA data sources Strong scripting and programming skills (e.g., Python, PowerShell) to automate tasks and analyze large datasets Excellent communication skills, both written and verbal, with the ability to explain complex technical concepts to non‑technical audiences Experience working with legal and HR teams on sensitive employee‑related matters Core Competencies Demonstrates expertise in leading insider threat investigations, utilizing advanced forensic tools and security technologies to analyze and respond to potential threats. Strong collaboration with cross‑functional teams ensures compliance with legal and privacy standards while effectively communicating findings to stakeholders. Tools & Technologies Security Information and Event Management (SIEM) Data Loss Prevention (DLP) Endpoint Detection and Response (EDR) User and Entity Behavior Analytics (UEBA) Forensic Tools #J-18808-Ljbffr Jobtailor