Insider Threat Security Engineer

Job Summary

To support a leading technology organization, the long-term remote contract Insider Threat Security Engineer will investigate insider threat incidents, perform proactive threat hunting, and lead incident response efforts while leveraging SIEM platforms like Splunk.

Key responsibilities

• Investigate suspected and confirmed insider threat incidents as part of the Cyber Security Incident Response Team (CSIRT)
• Perform proactive threat hunting activities to identify abnormal user behavior and potential security risks
• Develop, maintain, and optimize security detections, dashboards, and SPL queries within SIEM platforms

Required qualifications

• 8+ years of experience in cybersecurity, security operations, incident response, or threat hunting
• Strong experience with Splunk or comparable SIEM solutions
• Proven ability to write and modify advanced SPL searches and detection logic
• Hands-on experience with UBA and/or UEBA platforms
• Strong understanding of networking fundamentals including TCP/IP and network security