Onsite Insider Threat Analyst — TS/SCI, Splunk & DLP

Piper Companies; Camp Springs (MD); On-site; USD 78,000 - 130,000; Full time

Job summary

Zachary Piper Solutions seeks an Insider Threat Support Analyst to support a federal agency in the Washington, DC area. This onsite role focuses on insider threat detection, risk mitigation, and data protection within a cybersecurity program.

The candidate should hold an active TS clearance with SCI eligibility, a Security+ or CISSP certification, and 2+ years in insider threat or user activity monitoring, with hands-on Splunk experience and familiarity with DLP, EDR/NDR, IAM, and Teramind.

Qualifications

• Active Top Secret Clearance with SCI eligibility is required.
• Security+ or CISSP certification or equivalent.
• 2+ years of insider threat or user activity monitoring experience.
• Hands-on Splunk experience, including dashboards and searches.

Responsibilities

• Monitor and triage insider threat alerts across Splunk, DLP, EDR, IAM, and user activity monitoring tools.
• Investigate suspicious user behavior, potential data exfiltration, and policy violations.
• Apply risk-scoring methodologies to assess and prioritize insider threat events.
• Document investigative findings, evidence, and recommended actions.
• Develop and maintain Splunk dashboards, searches, and reporting capabilities.
• Collaborate with cybersecurity, incident response, and intelligence teams on investigations.
• Support insider threat trend analysis, reporting, and monitoring improvements.

Skills

Top Secret Clearance

Security+ or CISSP

Splunk experience

Analytical thinking

Communication skills

Education

Bachelor's degree in a related field

2+ years insider threat or user activity monitoring experience

Tools

Splunk

DLP

EDR/NDR

IAM

Teramind

Job description

Zachary Piper Solutions seeks an Insider Threat Support Analyst to support a federal agency in the Washington, DC area. This onsite role focuses on insider threat detection, risk mitigation, and data protection within a cybersecurity program.

The candidate should hold an active TS clearance with SCI eligibility, a Security+ or CISSP certification, and 2+ years in insider threat or user activity monitoring, with hands-on Splunk experience and familiarity with DLP, EDR/NDR, IAM, and Teramind.