Staff Insider Risk Engineer

Make your impact within a rapidly growing Fintech Company

BILL is looking to hire a Staff Insider Risk Engineer to join the Security Operations Center to support the insider risk and digital forensics functions. Protecting the company's data, systems, and employees is mission-critical to maintaining the trust of our customers and partners. 

The Insider Risk role sits at the intersection of security operations, digital forensics, and cross-functional partnership with People, Legal, and Safety and Security teams, directly shaping how BILL identifies, investigates, and remediates insider threats. You’ll combine investigative tradecraft, behavioral analysis, technical telemetry, and AI-assisted workflows to rapidly assess risk and drive informed security decisions.

Detection Engineering & Alert Fidelity Optimization: Design, build, and continuously refine insider threat detection logic, use cases, and analytics to improve signal quality. Leverage AI to accelerate investigations, validate findings, and improve decision-making. Identify opportunities to automate repetitive work and improve investigative workflows.

Alert Triage and Investigation: Triage and investigate insider threat alerts, applying structured methodologies to assess risk and using forensics to complete thorough analyses. Translate investigation outcomes into control improvements.

Detection Strategy & Use Case Development: Develop and implement a scalable detection strategy aligned to key insider threat risks (i.e., data exfiltration, employee exit risk, misuse). Identify gaps and prioritize new detection use cases to expand coverage and effectiveness

Cross-Functional Partnership: Partner with InfoSec, IT, Legal, and HR teams to ensure detections are risk-aligned, context-aware, and operationally actionable. Incorporate business context and investigation requirements into detection design to improve alert fidelity and response effectiveness.

Security Operations Collaboration: Provide support during high-risk security incidents where forensics and related skills are required. 

Responsibilities

• Conduct investigations into suspected insider threats, including data exfiltration, policy violations, and risky behavior
• Triage and validate alerts from the insider risk management program, determining severity and appropriate escalation path in line with the tiered risk framework
• Partner with the HR, Legal, and Privacy on remediation of confirmed insider incidents, including participation in employee interviews and documentation of findings
• Maintain chain-of-custody documentation and adhere to established digital forensics standards to preserve evidentiary integrity for all investigations
• Author clear, defensible investigation reports and file timelines that support HR and Legal decision-making on disciplinary or remediation actions
• Contribute to and continuously improve insider risk playbooks and working groups
• Support the design and tuning of detection use cases and monitoring baselines to improve identification of anomalous insider behavior
• Track metrics for leadership, with the intention of highlighting trends and improvement opportunities
• Support security operations efforts as capacity allows, given the close working relationship between insider risk and the broader security operations functions

We’d love to chat if you have:

• 7+ years of experience in insider risk, security operations, investigations, digital forensics, incident response, compliance, data protection, or enterprise risk management
• 2+ years of experience managing an insider risk program or conducting insider risk investigations
• Experience with forensic tools and endpoint data loss prevention platforms
• Experience with macOS, Windows, and cloud/container-based forensic analysis
• Familiarity with cloud platforms (e.g. AWS) and collaboration platforms (e.g., Google Workspace) and the ability to extract and interpret log data to support investigations
• Hands-on experience with security tools such as SIEM, UEBA, EDR, and email security solutions
• Excellent written and oral communication skills, with the ability to produce clear, factual, and defensible investigation documentation for stakeholders
• Sound judgment and discretion when handling sensitive, confidential, or privileged information
• Ability to work in high-pressure and time-sensitive situations while maintaining accuracy and objectivity
• Meticulous attention to detail and quality of work product
• Utilize AI to accelerate investigations and automate repetitive tasks

Visa Sponsorship: Please note that this position is not eligible for visa sponsorship. Applicants must have authorization to work in the United States without requiring visa sponsorship now or in the future.