Insider Threat Cyber Investigations Analyst

AGR, LLC; Arlington (VA); On-site; USD 100,000 - 150,000; Full time

Job summary

Redhawk Federal is seeking a Cyber Investigations Analyst to join the Federal Strategic Cyber Group in Rosslyn, VA. This full-time, on-site role supports end-to-end insider threat and cyber investigations using User Activity Monitoring and log data analysis.

The candidate will develop detection rules, conduct forensic analysis, and communicate findings to senior leadership. A TS clearance and detailed, formal reporting experience are required.

Qualifications

• Bachelor’s degree and 5 years of experience; an additional 4 years may substitute for the degree.
• Minimum of 2 years experience in cybersecurity, digital forensics, or cyber investigations.
• Active Top Secret security clearance or ability to obtain one.
• Experience conducting insider threat or cyber misconduct investigations in an enterprise environment.
• Experience analyzing large datasets of user activity, log data, and endpoint telemetry.
• Strong written and verbal communication, including formal investigative reports.
• Excellent time management with minimal supervision.
• Familiarity with SIEM platforms and UAM data.

Responsibilities

• Support the Cyber Threat Investigations & Analysis Division (CTAD) in end-to-end insider threat and cyber investigations using UAM tools and data.
• Collect, analyze, and interpret log data to detect anomalous user behavior and policy violations.
• Develop and refine detection rules, alerts, and behavioral baselines to improve threat detection.
• Conduct forensic analysis of user activity logs, endpoint telemetry, and network data.
• Communicate complex investigative findings to technical and non-technical stakeholders, including senior management.
• Collaborate with legal, HR, and security teams to ensure lawful investigations.
• Author detailed investigation reports, bulletins, and advisories.
• Promote insider threat awareness and UAM best practices among stakeholders.
• Respond to escalated security incidents and provide guidance on user activity threats.
• Manage case documentation in SharePoint repositories.
• Mentor junior team members on investigative techniques and tool usage.
• Stay current on insider threat TTPs and incorporate findings into detection strategies.

Skills

Analytical skills

Communication skills

Technical writing

Time management

Problem solving

Decision making

Mentorship

Education

Bachelor’s degree

Tools

Splunk

Microsoft Sentinel

EnCase

FTK

Magnet AXIOM

Active Directory

Azure AD

SharePoint

Job description

Redhawk Federal is seeking a Cyber Investigations Analyst to join the Federal Strategic Cyber Group in Rosslyn, VA. This full-time, on-site role supports end-to-end insider threat and cyber investigations using User Activity Monitoring and log data analysis.

The candidate will develop detection rules, conduct forensic analysis, and communicate findings to senior leadership. A TS clearance and detailed, formal reporting experience are required.