Insider Threat Security Engineer

Job Summary

To support a leading technology organization, the remote Insider Threat Security Engineer will investigate insider threat incidents, perform proactive threat hunting, and lead incident response efforts while working on a long-term contract basis.

Key responsibilities:

• Investigate suspected and confirmed insider threat incidents as part of the Cyber Security Incident Response Team (CSIRT)
• Perform proactive threat hunting to identify abnormal user behavior and potential security risks
• Develop and optimize security detections and dashboards within Splunk and other SIEM platforms

Required qualifications:

• 8+ years of experience in cybersecurity, incident response, or threat hunting
• Strong experience with Splunk or comparable SIEM solutions
• Proven ability to write and modify advanced SPL searches and detection logic
• Hands-on experience with UBA and/or UEBA platforms
• Strong understanding of networking fundamentals including TCP/IP and network security