Insider Threat Security Engineer

Job Summary

To support a leading technology organization, the long-term remote contract Insider Threat Security Engineer will investigate insider threat incidents, perform proactive threat hunting, and lead incident response efforts while optimizing security detections and collaborating with cross-functional teams.

Key responsibilities

• Investigate suspected and confirmed insider threat incidents as part of the Cyber Security Incident Response Team (CSIRT)
• Perform proactive threat hunting to identify abnormal user behavior and potential security risks
• Develop and maintain security detections, dashboards, and SPL queries within Splunk and other SIEM platforms

Required qualifications

• 8+ years of experience in cybersecurity, security operations, incident response, threat hunting, or insider threat programs
• Strong experience with Splunk or comparable SIEM solutions such as Microsoft Sentinel or QRadar
• Proven ability to write and modify advanced SPL searches and detection logic
• Hands-on experience with UBA and/or UEBA platforms for investigating suspicious activity
• Strong understanding of networking fundamentals including TCP/IP, DNS, and network security