JOB OVERVIEWThe
Insider Threat Analyst supports the Insider Threat Program Detection and Prevention (ITPDP) by performing day-to-day monitoring, detection, analysis, and triage of potential insider threat activity across enterprise environments. This role analyzes alerts and user activity from multiple security platforms to distinguish legitimate insider threat incidents from false positives, documents findings, and escalates cases as appropriate. Working under the direction of the Senior Insider Threat Analyst, the analyst supports the operation and continuous improvement of the insider threat program while ensuring all activities comply with federal insider threat policies, employee privacy protections, and civil liberties requirements.
Essential Functions:Insider Threat Monitoring and Detection- Monitor logs, dashboards, and alerts across multiple enterprise security applications to identify potential insider threat activity.
- Analyze user activity and system events to distinguish legitimate insider threat incidents from false positives.
- Continuously monitor enterprise environments for indicators of malicious, negligent, or compromised insider behavior.
Incident Triage and Investigation- Perform initial triage and investigation of potential insider threat alerts.
- Correlate information from multiple data sources to develop a complete understanding of potential insider threat activity.
- Escalate confirmed or ambiguous incidents to the Senior Insider Threat Analyst in accordance with established procedures.
- Maintain complete case documentation throughout the investigative lifecycle.
Detection Engineering Support- Assist with configuring, tuning, and troubleshooting detection rules, triggers, and analytics used by insider threat platforms.
- Support the deployment, maintenance, and day-to-day operation of enterprise insider threat detection technologies.
- Help improve detection fidelity by reducing false positives and refining alert logic.
Analysis and Reporting- Document investigative findings through clear analytical reports and case summaries.
- Maintain accurate records in accordance with program reporting requirements.
- Assist in developing workflows, playbooks, standard operating procedures, and other program documentation.
Collaboration and Program Support- Coordinate with Security Operations Center (SOC), investigative teams, Human Resources, Legal, and other stakeholders as directed.
- Support continuous improvement initiatives for the Insider Threat Program.
- Conduct all investigative activities in accordance with federal insider threat guidance while protecting employee privacy and civil liberties.
Qualifications:- U.S. Citizen with the ability to obtain and maintain a Tier 5 security clearance or higher.
- Bachelor's degree in Cybersecurity, Information Technology, Criminal Justice, Intelligence Studies, or a related field (additional relevant experience may be substituted for education).
- Approximately 6 years of combined experience in cybersecurity, security operations, investigations, digital forensics, insider threat, or related disciplines.
- Hands-on experience with one or more enterprise Insider Threat, DLP, SIEM, UEBA, or User Activity Monitoring (UAM) platforms such as Splunk, DTEX, Microsoft Purview, Proofpoint/ObserveIT, Exabeam, or similar technologies.
- Experience analyzing logs, alerts, dashboards, and user activity to differentiate true security incidents from false positives.
- Working knowledge of Windows, Linux, and Unix operating systems.
- Understanding of insider threat methodologies, user behavior analytics, event correlation, and investigative techniques.
- Familiarity with digital forensics concepts, log analysis, and security investigations.
- Knowledge of privacy, legal, and civil liberties considerations associated with federal Insider Threat Programs.
- Excellent analytical, documentation, and written communication skills.
- Ability to work effectively within an established insider threat program under the guidance of senior analysts.
- Ability to obtain the Counter-Insider Threat Fundamentals Certification, if required.
Desired:- Experience supporting formal Federal Insider Threat Programs.
- Experience with SIEM, UEBA, UAM, DLP, and behavioral analytics platforms.
- Familiarity with Splunk Enterprise Security, Microsoft Purview, DTEX, Exabeam, Proofpoint/ObserveIT, or similar solutions.
- Experience correlating events across multiple enterprise security tools.
- Knowledge of security operations center (SOC) workflows and incident response processes.
- Understanding of insider threat indicators, behavioral analytics, and risk scoring methodologies.
- Experience developing or improving detection rules, workflows, and investigative playbooks.
- Basic scripting experience (PowerShell, Python, or Bash) for automation or analysis.
- Familiarity with NIST, CNSSD, or other federal insider threat guidance and best practices.
- Strong collaboration skills when working with cybersecurity, investigative, legal, and human resources stakeholders.
PHYSICAL REQUIREMENTS & ENVIRONMENTAL CONDITIONS- Inside office environment.
- Working on a computer for long periods of time.
- May involve long period of sitting at a desk.
- The work environment is fast-paced and sometimes involves extreme deadline pressures.
OTHER DUTIESThis job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.
