Cybersecurity Analyst – Insider Risk Analytics

Swoon; United States; Remote; USD 74,000 - 105,000; Full time

Job summary

Swoon is seeking a highly technical Cybersecurity Analyst specializing in Insider Risk Analytics to support a global security team. The role focuses on insider threat detection, investigations, data analytics, and automation.

Expect hands-on work with SIEM, UEBA, and DLP, plus developing complex detection queries and dashboards. The ideal candidate will automate investigations using Python or PowerShell, collaborate across Security Engineering and IR teams, and identify emerging insider risk

Qualifications

• 3-4+ years in cybersecurity investigations or related security disciplines.
• Hands-on experience with SIEM, UEBA, and DLP technologies.
• Ability to develop complex SIEM queries and dashboards.

Responsibilities

• Analyze large datasets across security platforms to identify insider threats.
• Develop, test, and optimize SIEM detection rules and dashboards.
• Investigate alerts, reduce false positives, and improve detection accuracy.
• Build analytics reports and monitoring capabilities for investigations.
• Develop Python or PowerShell scripts to automate investigations.
• Collaborate with Security Engineering, Insider Risk, DLP, and IR teams.
• Identify insider risk trends and suggest monitoring improvements.

Skills

SIEM

UEBA

DLP

Security analytics

Threat detection

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Systems

Tools

SPL

KQL

YARA-L

SQL

Python

PowerShell

Job description

Now Hiring: Cybersecurity Analyst - Insider Risk Analytics

Location: 100% Remote (CST/EST preferred)

Pay: $65/hr

Duration: November 2026 - March 31, 2027

Employment Type: Full-Time Contract

Potential Extension: Yes

About the Opportunity

We are seeking a highly technical Cybersecurity Analyst specializing in Insider Risk Analytics to support a global enterprise security team.

This role focuses on insider threat detection, cybersecurity investigations, security data analytics, and automation. The ideal candidate will have strong hands-on experience with SIEM, UEBA, and DLP technologies, along with the ability to develop complex detection queries, build dashboards, and automate investigative workflows.

Key Responsibilities

• Analyze and correlate large datasets from multiple security platforms to identify suspicious user behavior, insider threats, and potential data loss incidents.
• Develop, test, and optimize SIEM detection rules, correlation searches, and advanced security monitoring queries.
• Investigate security alerts, identify false positives, and improve overall threat detection accuracy.
• Build and maintain dashboards, analytical reports, and monitoring capabilities to support cybersecurity investigations.
• Develop Python or PowerShell scripts to automate security investigations, alert enrichment, and data analysis.
• Collaborate with Security Engineering, Insider Risk, DLP, and incident response teams to strengthen threat detection capabilities.
• Identify emerging insider risk trends and recommend improvements to security monitoring processes.

Required Qualifications

• 3-4+ years of experience in cybersecurity investigations, security analytics, insider risk, SOC operations, or related security disciplines.
• Hands-on experience with SIEM, UEBA, and DLP technologies.
• Strong ability to independently develop complex SIEM queries, correlation searches, dashboards, and detection logic using SPL, KQL, YARA-L, SQL, or equivalent languages.
• Proficiency in Python, PowerShell, or similar scripting languages for security automation.
• Experience investigating suspicious activity, analyzing security events, and identifying behavioral anomalies.
• Strong knowledge of threat detection, incident response, and cybersecurity investigative processes.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience.

Preferred Qualifications

• Experience with Google Security Operations (Google SecOps / Chronicle) and YARA-L detection engineering.
• Previous experience supporting enterprise Insider Risk Management or Data Loss Prevention programs.
• Experience building advanced security dashboards and automated investigative workflows.
• Certifications such as CISSP, GCIH, GCITP, or relevant GIAC/SANS credentials.