Insider Threat Senior Analyst

Position Summary:

This position plays a pivotal role in proactively identifying, monitoring, investigating, and managing user- and endpoint-based insider threats that could compromise the confidentiality, integrity, and availability of critical data and resources. It collaborates closely with cross-functional teams to gather and preserve evidence, analyze user behavior and investigative data, coordinate and conduct investigations, and take appropriate actions to effectively mitigate insider threat risks. Responsibilities include creating and maintaining investigation and incident-tracking records, collecting and examining supporting artifacts and available information related to incidents or events, drafting and presenting detailed investigative reports and summaries, and ensuring thorough documentation throughout the investigative process. In addition, the position mentors teammates, reviews peer reports, and proactively contributes to the continuous improvement of the Insider Threat Management program to reduce overall insider threat risk.

Essential Skills and Responsibilities: 

• Conduct Insider Threat Investigations – Lead and support investigations involving user- and endpoint-based insider threats, ensuring timely identification, analysis, and resolution of potential risks. (Executing)
• Analyze User Behavior and Security Events – Monitor, assess, and interpret user activity, endpoint data, and security events to identify suspicious behaviors and potential insider threat indicators. (Executing)
• Collect and Preserve Evidence – Gather, preserve, and examine digital evidence, artifacts, and relevant data to support investigative findings and maintain evidentiary integrity. (Executing)
• Manage Incident Tracking and Documentation – Create, maintain, and update investigation records, case files, and incident-tracking systems to ensure accurate and comprehensive documentation. (Executing)
• Collaborate with Cross-Functional Stakeholders – Partner with legal, HR, security, compliance, and technical teams to coordinate investigations, validate findings, and support risk mitigation efforts. (Consulted)
• Develop and Present Investigative Reports – Prepare detailed investigative summaries, reports, and briefings that clearly communicate findings, risk assessments, and recommended actions to stakeholders and decision-makers. (Executing)
• Recommend Insider Threat Risk Mitigation Measures – Identify, assess, and recommend appropriate remediation and mitigation actions to reduce organizational insider threat risk. (Consulted)
• Provide Mentorship and Quality Review – Mentor team members, review peer investigations and reports, and promote investigative best practices and consistent analytical standards. (Accountable)
• Support Program Improvement Initiatives – Proactively contribute to the enhancement of Insider Threat Management processes, tools, and procedures to strengthen program effectiveness and maturity. (Consulted)
• Advise Leadership Through Investigative Expertise – Provide analysis, findings, and risk context that enable leadership and program owners to make informed decisions regarding insider threat cases and strategic risk management. (Informed)

QUALIFICATIONS AND EDUCATION

• Bachelor’s degree (master’s degree preferred)
• At least 8 years of experience in the cyber, investigative analysis, or the intelligence field.
• At least 5 years of experience leading or conducting investigations, or…
• At least 5 years of experience leading or conducting technical investigations utilizing insider threat tools (UEBA, SIEM).
• Proven experience in cybersecurity investigations, digital forensics, or a related field.
• Strong knowledge of insider threat detection techniques and best practices.
• Proficiency in digital forensics tools and incident response procedures.
• Relevant certifications such as Certified Information Systems Security Professional (CISSP), Certified Insider Threat Investigator (CITI), or equivalent are highly desirable.
• Excellent analytical and problem-solving skills.
• Knowledge of applicable laws and regulations related to data security and privacy.
• Exceptional communication and presentation skills.
• Ability to work collaboratively in a team and maintain confidentiality.
• Ability to mentor peers.

FINANCIAL/QUANTITIVE RESPONSIBILITIES

N/A

COMPARABLE POSITIONS/PEERS

• Investigator, Cyber Threat (00008575)
• Sr Investigator, Cyber Threat (00022239)

HOW HAS THE JOB CHANGED/GROWN

N/A

INTERNAL/ EXTERNAL RELATIONSHIPS

CSIRT – Incidents/Investigations - Frequent interactions

CTU – Investigations and threat hunting support – Frequent interactions

SIEM Team – Data support – Frequent interactions
HR / Legal – Investigation state holders - Frequent interactions

All other departments – As needed for data gathering or investigations

PHYSICAL REQUIREMENTS

N/A

WORKING CONDITIONS

Remote Office