Insider Threat Analyst: Detection & Investigation Expert

Agile Defense, Inc.; Washington (District of Columbia); On-site; USD 110,000 - 135,000; Full time

Job summary

Agile Defense is seeking an Insider Threat Analyst to support the Insider Threat Program Detection and Prevention (ITPDP). You will monitor alerts, analyze incidents, and document findings under the Senior Insider Threat Analyst.

This role emphasizes privacy and civil liberties while ensuring rigorous insider threat practices. Responsibilities include triage of indicators, tool configuration, and collaboration with SOC and investigative teams to protect national security interests.

Qualifications

• U.S. citizenship and ability to obtain/maintain a Top Secret clearance.
• BS or BA degree, or related experience in lieu of a degree.
• Approximately 6 years of combined experience across cybersecurity, security operations, investigations, or insider threat analysis.
• Hands-on experience with one or more enterprise insider threat, DLP, SIEM, or UEBA/UAM tools (e.g., Splunk, DTEX, Proofpoint/ObserveIT, Microsoft Purview, Exabeam, or similar).
• Demonstrated ability to analyze logs and dashboards to differentiate real incidents from false positives.
• Working knowledge of Windows, Unix, and Linux environments and common insider threat indicators and behaviors.
• Familiarity with log analysis, event correlation, and basic investigative techniques, including awareness of digital forensics concepts.
• Understanding of the legal and ethical requirements of an insider threat program as they relate to privacy and civil liberties.
• Strong written communication for documenting findings, and the ability to work under the direction of senior analysts within an established program.
• Ability to obtain the Counter-Insider Threat Fundamentals Certification if required.

Responsibilities

• Monitor and analyze logs and alerts from multiple applications to determine if activity is a real insider threat or a false positive.
• Triage and investigate potential insider threat indicators and escalate as needed.
• Support configuration, tuning, and troubleshooting of application triggers used for insider threat detection.
• Assist with deployment, operation, and maintenance of enterprise tools supporting insider threat detection.
• Document findings, produce analytical write-ups, and maintain case records.
• Correlate data across sources to build a complete picture of potential insider threat activity.
• Develop and refine workflows, playbooks, and program documentation.
• Ensure activities protect privacy and comply with insider threat program requirements.

Skills

Insider threat analysis

Log analysis

SIEM

DLP

UEBA/UAM

Written communication

Cross-team coordination

Education

BS or BA degree

Tools

Splunk

DTEX

Proofpoint/ObserveIT

Microsoft Purview

Exabeam

Job description

Agile Defense is seeking an Insider Threat Analyst to support the Insider Threat Program Detection and Prevention (ITPDP). You will monitor alerts, analyze incidents, and document findings under the Senior Insider Threat Analyst.

This role emphasizes privacy and civil liberties while ensuring rigorous insider threat practices. Responsibilities include triage of indicators, tool configuration, and collaboration with SOC and investigative teams to protect national security interests.