Insider Risk Security Engineer — Digital Forensics

CVS Health; Colorado; Hybrid; USD 83,000 - 222,000; Full time

Job summary

CVS Health seeks a Senior Security Engineer – Insider Risk to protect people, data, and operations by investigating insider threats and supporting digital forensics and incident response. You will analyze SIEM, EDR, DLP, and UBA data, build investigation timelines, perform forensic analyses, and prepare clear reports for technical and non-technical stakeholders.

This full‑time role requires 5+ years in information security, DoD 8140 certifications, and the ability to collaborate with HR, Legal,

Qualifications

• 5+ years of information security experience.
• 3+ years in digital forensics, incident response, or insider risk investigations.
• 1+ years of experience with evidence handling and chain of custody; modern digital forensic tooling (Axiom, VeraKey, ITR RECON).
• 2+ DoD 8140 active certifications with at least 1 intermediate technical qualification.

Responsibilities

• Conduct insider risk investigations and document findings in partnership with HR, Legal, Corporate Security, and cybersecurity stakeholders.
• Independently manage routine investigations and support senior analysts on high-sensitivity matters.
• Triage and correlate data across SIEM, EDR, DLP, UBA, and email security to identify insider risk activity.
• Perform digital forensic analysis on Windows, macOS, Android, and iOS devices.
• Prepare clear, factual reports and status updates for technical and non-technical audiences.
• Maintain case documentation and chain of custody.
• Partner with SOC, Corporate Security, Legal, HR, and business teams to support investigations.
• Identify trends and contribute to improvements in detection, investigation, and response capabilities.
• Participate in an on-call schedule for urgent investigations.

Skills

Insider risk investigations

Digital forensics

Incident response

Data analysis

Interrogation/interviewing techniques

Written communication

Education

Bachelor's degree

DoD 8140 certifications

Tools

SIEM

EDR

DLP

UBA

Axiom/VeraKey/ITR RECON

Splunk

Chronicle

Job description

CVS Health seeks a Senior Security Engineer – Insider Risk to protect people, data, and operations by investigating insider threats and supporting digital forensics and incident response. You will analyze SIEM, EDR, DLP, and UBA data, build investigation timelines, perform forensic analyses, and prepare clear reports for technical and non-technical stakeholders.

This full‑time role requires 5+ years in information security, DoD 8140 certifications, and the ability to collaborate with HR, Legal,