Insider Threat Senior Analyst

Royal Caribbean Group; Pasay; On-site; PHP 1,300,000 - 2,100,000; Full time

Job summary

Royal Caribbean Group is seeking an experienced Insider Threat Senior Analyst to proactively identify, monitor, and investigate insider threats affecting critical data and resources. You will collaborate with legal, HR, security, compliance, and technical teams, maintaining thorough investigative documentation and driving program improvements.

The role requires strong analytical skills, extensive experience in investigations, and the ability to mentor peers while guiding risk mitigation efforts

Qualifications

• 8+ years in cyber, investigative analysis, or intelligence fields.
• 5+ years leading or conducting investigations, including insider threats.
• 5+ years using insider threat tools (UEBA, SIEM).
• Certifications such as CISSP or CITI are highly desirable.
• Excellent analytical and problem-solving skills.
• Knowledge of data security and privacy regulations.

Responsibilities

• Lead and support insider threat investigations with timely identification, analysis, and resolution.
• Analyze user behavior, endpoint data, and security events to identify indicators.
• Collect, preserve, and examine digital evidence and relevant data.
• Create and maintain investigation records and incident-tracking systems.
• Collaborate with legal, HR, security, compliance, and technical teams to coordinate investigations and risk mitigation.
• Develop and present detailed investigative reports and risk assessments.
• Recommend insider threat risk mitigation measures and remediation actions.
• Mentor teammates and review peer investigations and reports.
• Contribute to program improvement initiatives and maturity of Insider Threat Management processes.
• Provide leadership with analysis and risk context to inform decisions.

Skills

Insider threat investigations

User behavior analysis

Evidence preservation

Incident tracking

Cross-functional collaboration

Investigative reporting

Risk mitigation recommendations

Mentorship

Program improvement

Leadership communications

Education

CISSP

CITI

Tools

UEBA

SIEM

Digital forensics tools

Job description

Select how often (in days) to receive an alert:

Insider Threat Senior Analyst

Position Summary:

This position plays a pivotal role in proactively identifying, monitoring, investigating, and managing user- and endpoint-based insider threats that could compromise the confidentiality, integrity, and availability of critical data and resources. It collaborates closely with cross-functional teams to gather and preserve evidence, analyze user behavior and investigative data, coordinate and conduct investigations, and take appropriate actions to effectively mitigate insider threat risks. Responsibilities include creating and maintaining investigation and incident-tracking records, collecting and examining supporting artifacts and available information related to incidents or events, drafting and presenting detailed investigative reports and summaries, and ensuring thorough documentation throughout the investigative process. In addition, the position mentors teammates, reviews peer reports, and proactively contributes to the continuous improvement of the Insider Threat Management program to reduce overall insider threat risk.

Essential Skills and Responsibilities:

• Conduct Insider Threat Investigations – Lead and support investigations involving user- and endpoint-based insider threats, ensuring timely identification, analysis, and resolution of potential risks. (Executing)
• Analyze User Behavior and Security Events – Monitor, assess, and interpret user activity, endpoint data, and security events to identify suspicious behaviors and potential insider threat indicators. (Executing)
• Collect and Preserve Evidence – Gather, preserve, and examine digital evidence, artifacts, and relevant data to support investigative findings and maintain evidentiary integrity. (Executing)
• Manage Incident Tracking and Documentation – Create, maintain, and update investigation records, case files, and incident-tracking systems to ensure accurate and comprehensive documentation. (Executing)
• Collaborate with Cross-Functional Stakeholders – Partner with legal, HR, security, compliance, and technical teams to coordinate investigations, validate findings, and support risk mitigation efforts. (Consulted)
• Develop and Present Investigative Reports – Prepare detailed investigative summaries, reports, and briefings that clearly communicate findings, risk assessments, and recommended actions to stakeholders and decision-makers. (Executing)
• Recommend Insider Threat Risk Mitigation Measures – Identify, assess, and recommend appropriate remediation and mitigation actions to reduce organizational insider threat risk. (Consulted)
• Provide Mentorship and Quality Review – Mentor team members, review peer investigations and reports, and promote investigative best practices and consistent analytical standards. (Accountable)
• Support Program Improvement Initiatives – Proactively contribute to the enhancement of Insider Threat Management processes, tools, and procedures to strengthen program effectiveness and maturity. (Consulted)
• Advise Leadership Through Investigative Expertise – Provide analysis, findings, and risk context that enable leadership and program owners to make informed decisions regarding insider threat cases and strategic risk management. (Informed)

QUALIFICATIONS AND EDUCATION

• At least 8 years of experience in the cyber, investigative analysis, or the intelligence field.
• At least 5 years of experience leading or conducting investigations, or…
• At least 5 years of experience leading or conducting technical investigations utilizing insider threat tools (UEBA, SIEM).
• Proven experience in cybersecurity investigations, digital forensics, or a related field.
• Strong knowledge of insider threat detection techniques and best practices.
• Proficiency in digital forensics tools and incident response procedures.
• Relevant certifications such as Certified Information Systems Security Professional (CISSP), Certified Insider Threat Investigator (CITI), or equivalent are highly desirable.
• Excellent analytical and problem-solving skills.
• Knowledge of applicable laws and regulations related to data security and privacy.
• Exceptional communication and presentation skills.
• Ability to work collaboratively in a team and maintain confidentiality.
• Ability to mentor peers.

FINANCIAL/QUANTITIVE RESPONSIBILITIES

N/A

COMPARABLE POSITIONS/PEERS

HOW HAS THE JOB CHANGED/GROWN

N/A

INTERNAL/ EXTERNAL RELATIONSHIPS

CSIRT – Incidents/Investigations - Frequent interactions

CTU – Investigations and threat hunting support – Frequent interactions

SIEM Team – Data support – Frequent interactions
HR / Legal – Investigation state holders - Frequent interactions

All other departments – As needed for data gathering or investigations