Insider Threat Investigator (Counterintelligence Officer 3)

Los Alamos National Laboratory; Los Alamos (NM); On-site; USD 90,000 - 130,000; Full time

Job summary

Los Alamos National Laboratory is seeking an experienced Insider Threat Investigator to identify, assess, and mitigate insider threats across the organization.

The role requires strong investigative judgment, privacy awareness, and the ability to work with counterintelligence, security, HR, legal, and management teams to protect LANL’s missions and information.

Qualifications

• Extensive end-to-end investigative experience including planning, information collection, analysis, and reporting.
• Knowledge of privacy and civil liberties considerations, records management, and information protection.
• Familiarity with insider threat concepts, investigative methodologies, and relevant authorities.

Responsibilities

• Conduct and support investigations involving insider threat activity and related security concerns.
• Collect, review, analyze, and correlate information from diverse sources and teams.
• Develop investigative strategies, plans, timelines, leads, and findings.
• Conduct interviews and coordinate activities with internal and external stakeholders.
• Identify behavioral and technical indicators warranting further inquiry.
• Evaluate information objectively and develop supported recommendations.
• Prepare clear investigative reports and briefings for senior audiences.
• Maintain records in compliance with laws, policies, and privacy rules.
• Collaborate across counterintelligence, cybersecurity, HR, legal, and security functions.
• Support insider threat assessments and risk-informed mitigation recommendations.
• Identify trends and lessons learned to strengthen LANL's insider threat posture.

Skills

Investigative interviewing

Analytical skills

Privacy & civil liberties

Records management

Insider threat concepts

Cybersecurity basics

DLP familiarity

SIEM familiarity

UEBA familiarity

Tools

DLP

SIEM

UEBA

Job description

What You Will Do

This position is open for external candidates only to apply. Are you an experienced insider threat or counterintelligence professional? Are you interested in joining a dedicated team of professionals working to safeguard Los Alamos National Laboratory (LANL), its people, information, and mission? If so, we invite you to learn more about our opening for an Insider Threat Investigator 3. The Insider Threat Investigator 3 will support the identification, assessment, investigation, and mitigation of potential insider threats to LANL. The successful candidate will work across counterintelligence, security, cybersecurity, human resources, legal, and management functions to evaluate concerning activity while appropriately protecting employee privacy, due process, and organizational assets. This position requires a seasoned investigator with strong investigative and analytical skills, sound judgment, discretion, and demonstrated ability to objectively assess complex information and distinguish anomalous or legitimate workplace activity from behaviors that may warrant further inquiry.

LANL investigative efforts support national counterintelligence and insider threat goals and objectives under the direction of the Foreign Immigration, Visits and Analysis (FVA) Group Leader and the Office of Counterintelligence (OCI) Director.

In this position, you will:

• Conduct and support investigations involving suspected insider threat activity, including unauthorized disclosures, misuse of information or systems, data exfiltration, security violations, fraud, sabotage, and other potentially harmful activity.
• Collect, review, analyze, and correlate information from authorized counterintelligence, cybersecurity, personnel security, physical security, investigative, and other relevant sources.
• Develop investigative strategies, plans, timelines, leads, and documented findings.
• Conduct investigative interviews and coordinate investigative activities with appropriate internal and external stakeholders.
• Identify and assess behavioral, technical, and other indicators that may warrant additional inquiry or assessment.
• Evaluate investigative information objectively, distinguish anomalous activity from substantiated risk, and develop well-supported findings and recommendations.
• Prepare clear, concise, and factual investigative reports, briefings, referrals, and case documentation for technical and senior-level audiences.
• Maintain investigative records in accordance with applicable laws, policies, privacy requirements, and records-management standards.
• Collaborate with counterintelligence, cybersecurity, legal, human resources, employee relations, physical security, personnel security, and other organizational functions, as appropriate.
• Support insider threat assessments and develop proportionate, risk-informed recommendations for mitigation.
• Identify investigative trends, recurring indicators, and lessons learned that can strengthen LANL's insider threat posture, security controls, and prevention efforts.
• Handle sensitive, controlled, and classified information with discretion and professionalism.

What You Need

Minimum Job Requirements

Demonstrated extensive experience conducting complex, end-to-end investigations, including investigative planning, information collection, interviewing, analysis of qualitative and quantitative information, development of findings, and preparation of investigative reports. Demonstrated knowledge of investigative principles and practices, evidence handling, privacy and civil liberties considerations, records management, and information-protection requirements. Knowledge of insider threat concepts, indicators, investigative methodologies, organizational roles, and relevant policies and authorities, such as Executive Order 13587 and DOE Order 470.5A. Familiarity with cybersecurity and insider threat capabilities such as data loss prevention (DLP), security information and event management (SIEM), user and entity behavior analytics (UEBA), or related security technologies.

Analysis, Reports, and Briefings

Demonstrated experience analyzing complex and potentially conflicting information, developing defensible findings and recommendations, and preparing professional investigative reports and other written products.

Demonstrated experience briefing investigative findings, assessments, and recommendations to decision-makers, including senior management.

Communication And Interpersonal Skills

Demonstrated ability to build productive working relationships and collaborate effectively across organizational and functional boundaries. Ability to interact professionally with personnel throughout LANL, the Department of Energy Office of Intelligence and Counterintelligence (DOE-IN), other DOE counterintelligence and insider threat