Insider Threat Security Engineer

Job Summary

To support a leading technology organization, the long-term contract Insider Threat Security Engineer will work remotely in the United States, focusing on identifying, investigating, and mitigating internal security threats as part of the Computer Security Incident Response Team (CSIRT).

Key responsibilities

• Investigate actual and suspected insider security incidents as part of the CSIRT
• Conduct threat hunting activities to proactively identify anomalous user behavior across the enterprise
• Lead incident response efforts, including investigation, containment, remediation, and documentation of security events

Required qualifications

• 8+ years of experience in cybersecurity, incident response, threat hunting, or security operations
• Hands-on experience with Splunk or comparable SIEM platforms
• Ability to create and modify SPL queries from scratch
• Experience utilizing UBA and/or UEBA solutions to investigate suspicious user activity
• Strong understanding of networking concepts, including TCP/IP and network security fundamentals