Insider Threat Security Engineer

Job Summary

To support a leading technology organization, the long-term contract Insider Threat Security Engineer will investigate insider security incidents, conduct threat hunting activities, and lead incident response efforts while working remotely in the United States.

Key responsibilities

• Investigate actual and suspected insider security incidents as part of the Computer Security Incident Response Team (CSIRT)
• Conduct threat hunting activities to proactively identify anomalous user behavior across the enterprise environment
• Lead incident response efforts, including investigation, containment, remediation, and documentation of security events

Required qualifications

• 8+ years of experience in cybersecurity, incident response, threat hunting, security operations, or insider threat programs
• Hands-on experience with Splunk or comparable SIEM platforms
• Ability to create and modify SPL queries from scratch
• Experience utilizing UBA and/or UEBA solutions to investigate suspicious user activity
• Strong understanding of networking concepts including TCP/IP, DNS, routing, and switching