Insider Threat Detection Engineering Lead

Citigroup Inc.; Irving (TX); On-site; USD 126,000 - 189,000; Full time

Job summary

Citigroup Inc. is seeking an Insider Threat Engineering Support Lead to join the Cybersecurity Operations & Engineering team in Irving, TX.

This role focuses on detecting, mitigating, and engineering controls around internal human-risk factors, with a hands-on engineering and analytics emphasis. The ideal candidate blends investigative thinking with engineering to design, tune, and operationalize high-fidelity detections, and to hunt across massive telemetry datasets while improving insider

Qualifications

• Core cybersecurity/insider threat concepts with human-centric risk models.
• 6+ years building/tuning queries in SIEM/data platforms (Splunk, KQL/Sentinel, Elastic, SQL, Snowflake).
• Proactive, hypothesis-based threat hunting across enterprise logs.
• Detail-oriented data analysis and troubleshooting of large datasets.
• Ability to work independently and manage high-impact priorities.

Responsibilities

• Develop, test, tune, and maintain behavioral analytics and SIEM detection rules.
• Translate insights into automated, resilient detection logic.
• Monitor detection effectiveness and minimize false positives while maximizing coverage.
• Conduct hypothesis-driven threat hunting across multi-source logs.
• Collaborate with incident response to operationalize findings into safeguards.

Skills

Domain knowledge

Query & detection engineering

Threat hunting

Data analysis

Self-directed execution

Hybrid engineering

Education

Bachelor’s degree

Master’s degree preferred

Tools

Splunk

KQL/Sentinel

Elastic

SQL

Snowflake

Job description

Citigroup Inc. is seeking an Insider Threat Engineering Support Lead to join the Cybersecurity Operations & Engineering team in Irving, TX.

This role focuses on detecting, mitigating, and engineering controls around internal human-risk factors, with a hands-on engineering and analytics emphasis. The ideal candidate blends investigative thinking with engineering to design, tune, and operationalize high-fidelity detections, and to hunt across massive telemetry datasets while improving insider