Job DescriptionSIEM Engineering & Insider Risk Analytics SME We're seeking a future team member for the role of
SIEM Engineering & Insider Risk Analytics SME to join our cybersecurity and insider risk team. This role is in Houston, TX.
The ideal candidate will have a strong background in SIEM engineering, cybersecurity operations, data analytics, and User and Entity Behavior Analytics (UEBA), with experience working across multiple risk domains. They will collaborate with cross-functional teams to integrate monitoring technologies, improve threat visibility, identify High-Risk Users, develop and tune use cases, protect crown jewel assets, strengthen operational processes, and prioritize risk through a combination of user inherent risk and observed user behavior.
Key Responsibilities SIEM Engineering & Platform Management: - Design, stand up, configure, deploy, maintain, and support enterprise SIEM platforms for security monitoring, insider risk detection, and threat response.
- Develop and fine-tune correlation rules, use cases, UEBA models, and behavioral analytics to identify High-Risk Users and detect insider risk, fraud, and advanced cyber threats, prioritizing risk through user inherent risk, observed behavior, and potential exposure to crown jewel assets.
- Assist in the management of log ingestion pipelines and optimize data collection from network, endpoint, cloud, identity, workstation monitoring, and other security data sources.
- Deploy, support, and troubleshoot User Enhanced Monitoring workstations and related platform integrations, performance, and data-processing pipelines.
Data Analytics & Threat Intelligence:• Develop data models, analytics dashboards, reports, and risk-scoring approaches that enhance security monitoring, forensic investigations, and user risk prioritization.
• Apply AI, machine learning, statistical analysis, and behavioral analytics to detect anomalies, identify emerging patterns, and improve insider risk detection.
• Integrate SIEM, threat intelligence, endpoint, identity, case management, and other security applications into a unified insider risk program.
• Conduct trend and threat analysis across multiple risk domains and a broad range of cyber and insider risk scenarios to support High-Risk User identification, crown jewel protection, proactive risk mitigation, early detection, and rapid response.
Incident Detection & Response Support:• Collaborate with Insider Threat analysts, threat hunters, fraud teams, and other security partners to investigate incidents using SIEM, UEBA, endpoint, identity, and workstation monitoring data.
• Maintain and enhance insider risk workflows through use case development, alert tuning, automation, process improvements, and response orchestration that reduce time to detection and response.
• Assist in root cause analysis and remediation efforts for complex security threats.
Compliance & Optimization:• Ensure SIEM configurations align with regulatory requirements (e.g., NIST, PCI DSS).
• Maintain documentation for use cases, data flows, integrations, operating procedures, risk-scoring logic, and SIEM policies across the unified insider risk program.
• Identify and implement improvements to log ingestion, data normalization, system scalability, analytic coverage, operational processes, and program effectiveness.
• Provide peer review of use cases and threat models to ensure efficacy and effectiveness.
Qualifications & Experience• Experience in SIEM engineering, cybersecurity operations, or data analytics.
10-12 years of experience in information security or related technology experience required, experience in the securities or financial services industry is a plus
• Strong hands-on experience with enterprise SIEM platforms, including platform implementation and support, rule and use case development, log ingestion, integrations, and dashboard development.
• Proficiency in SQL, Python, Splunk, Elastic Stack, or other data analytics tools.
• Experience with threat detection, UEBA development, AI and machine learning in security, and risk prioritization using both user inherent risk and user behavior.
• Familiarity with cloud security monitoring (AWS, Azure, GCP) and integration with SIEM solutions.
• Knowledge of MITRE ATT&CK, insider risk and fraud detection, user and entity behavior analytics, crown jewel protection, and a broad range of cyber threats, attack patterns, adversary techniques, and risk domains.
• Strong understanding of log management, data correlation, and incident response frameworks.
• Certifications such as SANS GIAC, CISSP, CEH, or relevant SIEM, analytics, cloud, or AI certifications are a plus.
Preferred Skills:• Experience working in the financial sector with a focus on fraud prevention, insider risk, or compliance monitoring.
• Knowledge of big data platforms (Hadoop, Spark, Snowflake), automation tools (SOAR, Python scripting, APIs), and integration patterns for connecting security applications across an insider risk ecosystem.
• Experience applying analytics across multiple risk domains to identify High-Risk Users, assess access and behavioral risk, and protect crown jewel assets and other critical resources.
• Experience deploying and supporting User Enhanced Monitoring workstations, working with large datasets, and building predictive or AI-assisted models for actionable security insights.
Our Benefits and Rewards:
BNY offers highly competitive compensation, benefits, and wellbeing programs rooted in a strong culture of excellence and our pay-for-performance philosophy. We provide access to flexible global resources and tools for your life's journey. Focus on your health, foster your personal resilience, and reach your financial goals as a valued member of our team, along with generous paid leaves, including paid volunteer time, that can support you and your family through moments that matter.
BNY assesses market data to ensure a competitive compensation package for our employees. The expected base salary for this position when employment commences can be found in the Job Info section at the bottom of the posting.
Base salary offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. Base salary is only part of the total rewards package, which may include eligibility for an annual discretionary incentive award. Subject to the terms and conditions of the applicable plans then in effect, eligible employees may enroll in a 401(k) plan as well as participate in Company-sponsored medical, dental, vision, and basic life insurance plans for the employee and the employee's eligible dependents. Eligible employees also may receive other benefits (including various paid time off benefits, such as vacation and sick time), dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.
If hired, the employee will be in an "at will" position and the Company reserves the right to modify base salary (as well as any other discretionary payments or compensation programs) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.
