Insider Risk Investigations Analyst

Insider Risk Investigations Analyst Location: Remote (EST Preferred) Duration: 6 Months Contract (likely extension) We are seeking an Insider Risk Investigations Analyst to support a global security organization focused on insider threat detection, investigations, and data protection initiatives. This role will work closely with senior investigators to review suspicious user activity, analyze security alerts, support investigations, and help protect sensitive corporate data. The ideal candidate will have hands‑on experience with insider risk investigations, security monitoring tools, advanced KQL querying, and Python scripting. Strong analytical, documentation, and communication skills are essential. Responsibilities Support day-to-day insider risk and data protection investigations. Review and analyze alerts from DLP, SIEM, UEBA, CASB, EDR, and related security platforms. Investigate potential indicators of insider threat activity including: Data exfiltration Mass file downloads Unusual access patterns Unauthorized transfers of sensitive information Gather and organize investigation artifacts including logs, timelines, screenshots, and supporting evidence. Document findings and prepare case summaries for senior investigators and leadership. Assist with root cause analysis and identification of behavioral patterns. Support remediation efforts and user outreach activities as required. Follow established investigation playbooks, escalation procedures, and data handling standards. Maintain detailed documentation within case management systems. Participate in user and manager interviews by documenting discussions and key findings. Required Skills Experience supporting Insider Risk, Insider Threat, Data Protection, Cyber Investigations, or Security Operations programs. Strong hands‑on Kusto Query Language (KQL) experience. Strong Python scripting and automation skills. Experience with Microsoft Sentinel and security analytics. Familiarity with DLP, SIEM, UEBA, CASB, and EDR technologies. Ability to analyze logs, user activity, and security events to identify suspicious behavior. Experience documenting investigations and managing case artifacts. Excellent written and verbal communication skills. Strong attention to detail and ability to handle sensitive information confidentially. Preferred Experience Microsoft Sentinel analytic rule development. Advanced KQL query development and optimization. Watchlists, materialized views, dynamic data types, and complex data correlation within Sentinel. Experience supporting enterprise‑scale insider risk programs. Security certifications such as Security+, SC-200, GCIA, GCIH, or similar. Key Technologies: KQL, Microsoft Sentinel, Python, DLP, SIEM, UEBA, CASB, EDR, Microsoft Security Stack, Insider Risk Management, Security Investigations, Log Analysis, Incident Response, Data Protection. #J-18808-Ljbffr VDart Inc