Lead Security Monitoring and Response Analyst (Insider Threat Program Lead)

Hbcu Connect, Llc; O’Fallon (MO); On-site; USD 122,000 - 207,000; Full time

Benefits offered by this job

Insurance

Paid time off

401k match

Tuition reimbursement

Job summary

Mastercard is seeking a Lead Insider Threat Analyst to direct the Insider Threat program across Security Operations. You will set standards, lead investigations, and drive improvements in DLP, UAM, and UBA while balancing business needs with privacy and regulatory requirements.

The role requires strong incident response and forensics experience, with collaboration across HR, Legal, Privacy, and Compliance to mature the security program.

Qualifications

• Experience in sensitive investigations with privacy and regulatory considerations.
• Strong background in security operations, incident response, insider risk, and digital forensics.
• Ability to explain complex technical matters to diverse audiences and influence stakeholders.
• Understanding privacy, data protection laws (GDPR and related) in operational settings.
• Experience governing Insider Threat, DLP, UAM, and UBA security capabilities.

Responsibilities

• Set Insider Threat investigation standards and guide SMEs on complex, high-risk cases.
• Analyze program trends, risks, and metrics to support leadership decisions.
• Build Insider Threat detection strategies, controls, and countermeasures.
• Drive DLP, UAM, and UBA capabilities with technology owners.
• Maintain Insider Threat policies, processes, and operating standards.
• Lead Insider Threat Working Group and coordinate with Steering Committee.

Skills

Insider threat

Security operations

Incident response

Digital forensics

Privacy compliance

OSINT

Education

Bachelor's degree in a relevant field

Tools

Microsoft Purview

Microsoft Defender/IRM

Microsoft Sentinel

Endpoint DLP

Job description

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, were helping build asustainableeconomy where everyone can prosper. We support a wide range of digital payments choices, making transactionssecure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary

Lead Security Monitoring and Response Analyst (Insider Threat Program Lead)Who is Mastercard?

Mastercard is a global technology company in the payments industry. Our mission is to connect and power an inclusive, digital economy that benefits everyone, everywhere by making transactions safe, simple, smart, and accessible. Using secure data and networks, partnerships, and passion, our innovations and solutions help individuals, financial institutions, governments, and businesses realize their greatest potential.

Our decency quotient, or DQ, drives our culture and everything we do inside and outside of our company. With connections across more than 210 countries and territories, we are building a sustainable world that unlocks priceless possibilities for all.

Mission First, People Always

As Corporate Security, we are responsible for keeping Mastercard safe and secure from cyber and physical threats, and it is our people on the frontwho make this happen every day.

By taking care of our people, their well-being, and their career development, we provide them with the necessary tools and environment to ensure the success of our mission.

Overview

The Security Event Management group is seeking a highly motivated and experienced security professional to lead the direction and continued maturity of Mastercard's Insider Threat capability.

As the Lead Insider Threat specialist, you will serve as the functional authority for Insider Threat across Security Operations, setting direction, defining standards, and driving the evolution of people, process, and technology capabilities that enable the organization to identify, detect, and respond to insider risk. This role provides leadership through expertise, influence, and decision-making, working across a global network of security and business stakeholders.

The role is responsible for establishing and maintaining the Insider Threat operating model and guiding the implementation of improvements across Data Loss Prevention (DLP), User Activity Monitoring (UAM), User Behavior Analytics (UBA), investigations, detection content, monitoring procedures, case management processes, and supporting technologies. Working closely with Security Operations SMEs and operational teams, you will identify capability gaps, define enhancements, develop roadmap priorities, and ensure the Insider Threat function continues to mature in response to evolving business requirements and threat landscapes.

You will act as the primary advisor on Insider Threat strategy, policies, standards, and procedures, balancing security objectives with business, privacy, legal, regulatory, and human resources requirements. Through collaboration and influence, you will drive consistency, operational excellence, and the adoption of best practices across the organization.

This role requires a forward-looking mindset, continually assessing emerging Insider Threat tactics, techniques, and procedures (TTPs), industry trends, and technological advancements to develop and implement improvements that strengthen Mastercard's overall Insider Threat capability and long-term resilience.

As operational needs arise, this role may directly lead investigations or incident response activities.

In this role you will:

• Set Insider Threat investigation standards and guide SMEs on complex, high-risk cases.
• Analyze program trends, risks, and metrics to identify improvements and support leadership decisions.
• Build Insider Threat detection strategies, controls, and countermeasures aligned to emerging TTPs.
• Drive the direction and maturity of DLP, UAM, and UBA capabilities with technology owners.
• Maintain Insider Threat policies, processes, procedures, and operating standards.
• Serve as the lead Insider Threat liaison for Technology, Security, HR, Legal, Privacy, Compliance, and M&A partners.
• Assess capabilities and risks, identify control gaps, define remediation plans, and drive the resolution of issues.
• Define capability roadmaps and partner with engineering teams to deliver tool and platform enhancements.
• Track industry trends, emerging threats, and best practices to advance program maturity.
• Maintain current, accurate, and published program documentation and inventories.
• Design exercises to test and strengthen Insider Threat capabilities.
• Lead the Insider Threat Working Group and elevate priorities to the Insider Threat Steering Committee.

All About You

• A demonstrated ability to conduct, oversee, or support sensitive, confidential investigations involving employee activity while maintaining the highest standards of professionalism, discretion, objectivity, evidentiary integrity, and privacy compliance, also balancing security, privacy, legal, and human resources considerations.
• Extensive experience in security operations, incident response, insider risk, digital forensics, or related cybersecurity disciplines.
• A strong understanding of investigative methodologies, evidentiary handling, chain of custody, and detailed report writing, with the ability to influence stakeholders and explain complex technical matters to diverse audiences.
• The ability to consistently apply an understanding of privacy, data protection, and regulatory considerations, including GDPR and related legislation, to operational requirements.
• Experience developing, enhancing, or governing Insider Threat, Data Loss Prevention, User Activity Monitoring, User Behavior Analytics, or related security capabilities.
• Experience with Microsoft security technologies, including Microsoft Purview, Microsoft Defender / IRM, Microsoft Sentinel, and Endpoint DLP.
• Experience with Security Information and Event Management (SIEM) platforms and security event analysis.
• Working knowledge of Windows and macOS operating systems, including key architectural and investigative differences.
• Familiarity with threat hunting methodologies, open-source intelligence (OSINT), and cyber investigation techniques.
• Relevant industry certifications such as CISSP, GCIH, GCIA, Security+, or equivalent; desirable.

Corporate Security Responsibility

• Abide by Mastercards security policies and practices;
• Ensure the confidentiality and integrity of the information being accessed;
• Report any suspected information security violation or breach, and
• Complete all periodic mandatory security trainings in accordance with Mastercards guidelines.

In line with Mastercards total compensation philosophy and assuming that the job will be performed in the US, the successful candidate will be offered a competitive base salary and may be eligible for an annual bonus or commissions depending on the role. The base salary offered may vary depending on multiple factors, including but not limited to location, job-related knowledge, skills, and experience. Mastercard benefits for full time (and certain part time) employees generally include: insurance (including medical, prescription drug, dental, vision, disability, life insurance); flexible spending account and health savings account; paid leaves (including 16 weeks of new parent leave and up to 20 days of bereavement leave); 80 hours of Paid Sick and Safe Time, 25 days of vacation time and 5 personal days, pro-rated based on date of hire; 10 annual paid U.S. observed holidays; 401k with a best-in-class company match; deferred compensation for eligible roles; fitness reimbursement or on-site fitness facilities; eligibility for tuition reimbursement; and many more. Mastercard benefits for interns generally include: 56 hours of Paid Sick and Safe Time; jury duty leave; and on-site fitness facilities in some locations.

THIS POSTING RELECTS ONE OR MORE CURRENT VACANCIES ON OUR TEAM, AND MASTERCARD INTENDS TO FILL THIS POSITION BY 01/10/2027. If the fill date has passed, Mastercard intends to fill this position as soon as possible.

Pay Ranges

O'Fallon, Missouri: $122,000 - $207,000 USD