Insider Threat Security Engineer

Job Summary

Working remotely in a long-term contract role, the Insider Threat Security Engineer will investigate insider security incidents, conduct threat hunting activities, and lead incident response efforts to mitigate internal security threats across the enterprise.

Key responsibilities

• Investigate actual and suspected insider security incidents as part of the Computer Security Incident Response Team (CSIRT)
• Conduct threat hunting activities to proactively identify anomalous user behavior across the enterprise environment
• Lead incident response efforts, including investigation, containment, remediation, and documentation of security events

Required qualifications

• 8+ years of experience in cybersecurity, incident response, threat hunting, security operations, or insider threat programs
• Hands-on experience with Splunk or comparable SIEM platforms
• Ability to create and modify SPL queries from scratch
• Experience utilizing UBA and/or UEBA solutions to investigate suspicious user activity
• Strong understanding of networking concepts, including TCP/IP, DNS, routing, and switching