Insider Threat Intelligence Analyst

Evolver; Camp Springs (MD); On-site; USD 110,000 - 160,000; Full time

Job summary

Evolver is seeking an Insider Threat Support Analyst to join our Camp Springs, MD team onsite. You will identify, assess, and mitigate risks from trusted individuals, including employees, contractors, and partners, within our Cyber Intelligence Operations program.

The role emphasizes continuous improvement of detection strategies using telemetry from DLP, SIEM (Splunk), EDR/NDR, cloud storage, email, VPN/web, UAM (Teramind), and IAM logs.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field, OR 2+ years of dedicated insider threat experience.
• Active certification in Security+ or CISSP (or other approved) is required.
• 2+ years of SPLUNK architecture experience including UI/GUI development and operational roles.
• U.S. Citizenship with Top Secret clearance and SCI eligibility (ICD 704).

Responsibilities

• Independently run daily insider risk operations across telemetry sources (DLP, SIEM, EDR/NDR, UAM, IAM).
• Conduct end-to-end risk scoring and classify user activity; document cases and containment actions.
• Collaborate within a small team to share insights and cover operational gaps.
• Maintain and refine an insider use-case catalog; coordinate with Applied Intelligence and platform owners.
• Author Monthly InT Summaries focusing on metrics and false positives.
• Utilize SPLUNK architecture and Teramind for robust incident reporting.

Skills

Insider threat detection

Risk scoring & analytics

Cross-functional collaboration

Strong communication

Education

Bachelor's degree in Computer Science / Information Security or related field

2+ years insider threat detection experience

Tools

Splunk architecture

Teramind UAM

SPLUNK UI/GUI development

DLP logging

EDR/NDR logging

IAM logging

Job description

Evolver is seeking an Insider Threat Support Analyst to join our Camp Springs, MD team onsite. You will identify, assess, and mitigate risks from trusted individuals, including employees, contractors, and partners, within our Cyber Intelligence Operations program.

The role emphasizes continuous improvement of detection strategies using telemetry from DLP, SIEM (Splunk), EDR/NDR, cloud storage, email, VPN/web, UAM (Teramind), and IAM logs.