Insider Threat Security Engineer

Responsibilities: of the Insider Threat Security Engineer: • Investigate actual and suspected insider security incidents as part of the Computer Security Incident Response Team (CSIRT). • Conduct threat hunting activities and proactively identify anomalous user behavior across the enterprise environment. • Lead incident response efforts including investigation, containment, remediation, and documentation of security events. • Develop, optimize, and maintain SIEM detections and custom SPL queries to identify suspicious activity. • Utilize User Behavior Analytics (UBA) and User & Entity Behavior Analytics (UEBA) tools to detect insider threats and reduce organizational risk. • Collaborate with infrastructure, networking, and security teams to investigate complex incidents and improve detection capabilities. • Analyze logs, network traffic, system activity, and endpoint telemetry to support investigations and security monitoring efforts. Requirements of the Insider Threat Security Engineer: • 8+ years of experience in cybersecurity, incident response, threat hunting, security operations, or insider threat programs. • Hands-on experience with Splunk or comparable SIEM platforms such as QRadar, LogRhythm, Microsoft Sentinel, or Elastic. • Ability to create and modify SPL queries from scratch. • Experience utilizing UBA and/or UEBA solutions to investigate suspicious user activity. • Strong understanding of networking concepts including TCP/IP, DNS, routing, switching, and network security fundamentals. • Background in systems administration, network engineering, or infrastructure operations prior to moving into security is highly preferred. • Experience performing hands-on security investigations, threat hunting, and incident response activities. Compensation: for the Insider Threat Security Engineer: • $120,000 - $160,000 • Full Comprehensive Benefits: Health, Vision, Dental, PTO, Paid Holiday and Sick Leave if Required by Law.