Insider Threat Security Engineer - Remote CSIRT Lead

Piper Companies; United States; Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Medical, Dental, Vision

PTO

Paid Holidays

Additional leave offerings

Job summary

Piper Companies is seeking an Insider Threat Security Engineer to support a leading technology organization. This role focuses on detection, investigation, and remediation of insider threats within a CSIRT context, demanding hands-on threat hunting and incident response.

Remote contract opportunity within the United States is available. The candidate will develop detections and dashboards in Splunk and other SIEMs, implement UEBA/UBA approaches, and collaborate across teams to strengthen

Qualifications

• 8+ years in cybersecurity, security operations, incident response, threat hunting or insider threat programs.
• Experience writing advanced SPL searches and detection logic.
• Hands-on with UBA/UEBA platforms to identify insider risk.
• Strong networking fundamentals and collaboration with IT/security teams.

Responsibilities

• Investigate insider threat incidents as part of CSIRT.
• Perform proactive threat hunting to identify abnormal user behavior.
• Lead incident response from investigation through containment and remediation.
• Develop and optimize detections, dashboards, and SPL queries in SIEMs.
• Utilize UBA/UEBA to identify and mitigate insider risk across the environment.
• Collaborate with infrastructure, networking, and security teams on complex events.
• Analyze logs, endpoint telemetry, and network data to support investigations.

Skills

Threat hunting

Incident response

Insider threat

Security operations

UEBA/UBA

Threat detection

Tools

Splunk

Microsoft Sentinel

QRadar

LogRhythm

Elastic

Job description

Piper Companies is seeking an Insider Threat Security Engineer to support a leading technology organization. This role focuses on detection, investigation, and remediation of insider threats within a CSIRT context, demanding hands-on threat hunting and incident response.

Remote contract opportunity within the United States is available. The candidate will develop detections and dashboards in Splunk and other SIEMs, implement UEBA/UBA approaches, and collaborate across teams to strengthen