Insider Threat Detection Engineer

Cypress HCM; United States; On-site; USD 169,000 - 190,000; Full time

Job summary

Cypress HCM is seeking a security engineer to develop and execute insider threat detection and response capabilities. You will work across engineering, HR, and Legal to build scalable detection and investigation tooling and participate in 24/7 threat monitoring.

The role emphasizes hands-on security operations, threat hunting, and collaboration to mitigate insider threats across corporate and production environments in a fast-paced setting.

Qualifications

• Bachelor's degree or equivalent practical experience.
• Experience with Insider Threat technologies (DLP, UEBA, etc.).
• Exposure to data science and analytics solutions in insider threat space.

Responsibilities

• Identify gaps in infrastructure and gain visibility through logging and detection.
• Be part of on-call rotation to provide 24/7 coverage for threat detection and incident response.
• Use coding, data analytics and investigation skills to hunt, detect and respond to insider threats.
• Write detections to identify data abuse and data exfiltration at scale.
• Build automation and detection models to identify anomalous activity and mitigation actions.
• Hunt for insider threats in corporate and production environments.
• Collaborate with engineering to build advanced detection solutions and with HR/Legal for investigations.
• Consult on countermeasures to mitigate insider threats.

Skills

Detection engineering

Threat hunting

Incident response

Digital forensics

Threat intelligence

Security operations

On-call/24-7 coverage

Education

Bachelor's degree

Tools

Python

AWS

SQL

Job description

Cypress HCM is seeking a security engineer to develop and execute insider threat detection and response capabilities. You will work across engineering, HR, and Legal to build scalable detection and investigation tooling and participate in 24/7 threat monitoring.

The role emphasizes hands-on security operations, threat hunting, and collaboration to mitigate insider threats across corporate and production environments in a fast-paced setting.