Insider Threat Detection Engineering Lead

Citibank (Switzerland) AG; Irving (TX); Hybrid; USD 126,000 - 189,000; Full time

Job summary

Citi in Irving, Texas, seeks an inquisitive Insider Threat Engineering Support Lead to join Cybersecurity Operations & Engineering. The role blends security engineering, data analytics, and behavioral threat hunting to identify and mitigate internal risk, detect data movement, and tune high‑fidelity detection controls.

Responsibilities include developing and optimizing detection rules for SIEM/data platforms, proactive threat hunting across multi-source telemetry, and supporting end-to-end

Qualifications

• 6+ years of experience constructing, tuning, and executing complex queries within SIEM, data lake, or log analytics platforms (e.g., Splunk, KQL/Sentinel, Elastic, SQL, Snowflake).
• Experience in threat hunting to identify stealthy, anomalous, or policy-violating activity across enterprise log sources.
• Ability to navigate, sanitize, query, and troubleshoot high-volume datasets.
• Strong communication and ability to work independently in a fast-paced environment.

Responsibilities

• Detection Engineering & Rule Optimization: Develop, test, tune, and maintain behavioral analytics and detection rules to identify insider threats.
• Proactive Threat Hunting & Analytics: Conduct hypothesis-driven threat hunting across multi-source logs and telemetry data.
• Engineering Support & Process Improvement: Support SDLC, version control, documentation, testing, and deployment of detection artifacts.

Skills

Threat hunting

Detection engineering

Data analysis

Self-directed work

Communication

Education

Bachelor’s degree

Master’s degree preferred

Tools

Splunk

KQL/Sentinel

Elastic

SQL

Snowflake

Job description

Citi in Irving, Texas, seeks an inquisitive Insider Threat Engineering Support Lead to join Cybersecurity Operations & Engineering. The role blends security engineering, data analytics, and behavioral threat hunting to identify and mitigate internal risk, detect data movement, and tune high‑fidelity detection controls.

Responsibilities include developing and optimizing detection rules for SIEM/data platforms, proactive threat hunting across multi-source telemetry, and supporting end-to-end