Insider Threat Analyst Lead

Job Description

Description

Hybrid in Washington, DC\n
\n
\nOur client seeks an Insider Threat Analyst Lead to support a federal cybersecurity program focused on identifying, analyzing, and mitigating insider threats. The lead will direct insider threat analysis efforts, leverage behavioral analytics and SIEM tools, and drive investigative processes to detect and respond to risks posed by internal actors.\n
\n
Due to client requirements, applicants must be US Citizen and willing and able to work on a w2 basis. For our w2 consultants, we offer a great benefits package that includes Medical, Dental, and Vision benefits, 401k with company matching, and life insurance.

Rate: $80.00 to $130.00/hr. w2\n
\n
Responsibilities

\n

\n
• Lead and conduct in-depth technical analysis of insider threat activity across enterprise environments.
\n
• Perform behavioral analytics to identify anomalous user behavior, insider risk patterns, and potential threats.
\n
• Utilize SIEM tools, including Splunk, to correlate cybersecurity alerts and identify indicators of insider activity.
\n
• Manage and oversee end-to-end case management for insider threat investigations, including documentation and escalation.
\n
• Analyze large datasets to identify trends, patterns, and indicators related to insider threats.
\n
• Collaborate with SOC, incident response, HR, legal, and security teams to support investigations and mitigation actions.
\n
• Develop and refine insider threat detection methodologies and analytic approaches.
\n
• Provide reporting, briefings, and recommendations to leadership on insider threat risks and investigation outcomes.
\n
• Ensure compliance with federal policies and insider threat program requirements.

\n

Experience Requirements

\n

\n
• 5+ years conducting in-depth technical analysis of insider threats.
\n
• 3+ years conducting behavioral analytics.
\n
• 2+ years using Splunk SIEM to correlate cybersecurity alerts.
\n
• 2+ years managing overall case management for cybersecurity investigations.
\n
• Certified Cyber Insider Threat Professional (CCITP) Program.
\n
• Preferred: Experience supporting federal insider threat or counterintelligence programs.
\n
• Preferred: Familiarity with User and Entity Behavior Analytics (UEBA) tools and methodologies.
\n
• Preferred: Strong understanding of insider threat frameworks, governance, and compliance standards.
\n
• Preferred: Experience working with cross-functional stakeholders (security, legal, HR, compliance).
\n
• Preferred: Strong analytical, investigative, documentation, and communication skills.

\n

Education Requirements