Senior Security Engineer, Insider Threat Detection & Response

About the Role

We are seeking a Senior Security Engineer to help build and mature an insider threat detection and response program from the ground up. You will join a front-line security team that detects, investigates, and responds to threats against company data, systems, and infrastructure. In this role, you will shape detection capabilities through hands-on technical work and cross-functional influence, with direct impact on how the organization protects its most sensitive information.

Key Responsibilities

• Identify visibility gaps across infrastructure and partner with business teams to close them through improved logging and detection.
• Design and write detections for data misuse and data exfiltration at scale.
• Build automation and detection models that surface anomalous activity and speed up response.
• Proactively hunt for insider threats across corporate and production environments.
• Partner with engineering teams to develop advanced detection solutions, and work closely with Human Resources and Legal on complex investigations.
• Recommend and help design countermeasures that reduce insider risk.
• Take part in incident response and provide subject-matter expertise during insider threat incidents.
• Participate in an on-call rotation that supports 24/7 detection and response coverage.
• Contribute to security awareness messaging and training.

Qualifications

Required

• 5+ years of hands-on experience in security operations, such as detection engineering, threat hunting, incident response, digital forensics, or threat intelligence.
• Bachelor’s degree in a related technical field, or equivalent practical experience.
• Experience with insider threat technologies, such as Data Loss Prevention (DLP) and User and Entity Behavior Analytics (UEBA).
• Exposure to data science and analytics approaches that apply to insider threat detection.
• Experience automating security detection and response.
• Solid understanding of how insider threat and incident response connect, including how to coordinate responses to insider incidents.
• Working knowledge of insider threat challenges at consumer-facing companies.
• Familiarity with the Cyber Kill Chain and MITRE ATT&CK frameworks and how they apply to insider threats.
• Self-motivated, creative problem-solver who works well independently.
• Stays calm and collaborative under pressure in time-sensitive situations.
• Strong organization, prioritization, and multitasking skills.

Preferred

• Experience with AWS services such as EC2, S3, Lambda, and RDS.
• Proficiency in Python and SQL.

Key Details

• Start Date: November 17, 2026
• Duration: 12 months
• Location: Remote (within the U.S.)
• Work Schedule: Full-time, 40 hours per week (Monday-Friday), plus participation in an on-call rotation
• Pay Rate: Up to $120-$137/hour + benefits
• Work Authorization: Must be authorized to work in the U.S. without sponsorship.
• Engagement: W-2 Contract