Remote Insider Risk Engineer - AI-Driven Investigations

BILL; California (MO); Hybrid; USD 183,500 - 220,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) with company match

HSA & FSA accounts

Paid holidays & time off

Employee stock purchase program

Wellness initiatives

Job summary

BILL is hiring a Staff Insider Risk Engineer to join the Security Operations Center to support insider risk and digital forensics. You will help protect data, systems, and employees by designing detection use cases, triaging alerts, and collaborating with People, Legal, and Safety teams.

The role blends security operations, forensics, and AI-assisted workflows to drive informed security decisions and continuous improvement of playbooks.

Qualifications

• 7+ years of experience in insider risk, security operations, investigations, digital forensics, incident response, compliance, data protection, or enterprise risk management
• 2+ years of experience managing an insider risk program or conducting insider risk investigations
• Experience with forensic tools and endpoint data loss prevention platforms
• Experience with macOS, Windows, and cloud/container-based forensic analysis
• Familiarity with cloud platforms (e.g. AWS) and collaboration platforms (e.g., Google Workspace) and the ability to extract and interpret log data to support investigations
• Hands-on experience with security tools such as SIEM, UEBA, EDR, and email security solutions
• Excellent written and oral communication skills, with the ability to produce clear, factual, and defensible investigation documentation for stakeholders
• Sound judgment and discretion when handling sensitive, confidential, or privileged information
• Ability to work in high-pressure and time-sensitive situations while maintaining accuracy and objectivity
• Meticulous attention to detail and quality of work product
• Utilize AI to accelerate investigations and automate repetitive tasks

Responsibilities

• Conduct investigations into suspected insider threats, including data exfiltration, policy violations, and risky behavior
• Triage and validate alerts from the insider risk management program, determining severity and appropriate escalation path in line with the tiered risk framework
• Partner with the HR, Legal, and Privacy on remediation of confirmed insider incidents, including participation in employee interviews and documentation of findings
• Maintain chain-of-custody documentation and adhere to established digital forensics standards to preserve evidentiary integrity for all investigations
• Author clear, defensible investigation reports and file timelines that support HR and Legal decision-making on disciplinary or remediation actions
• Contribute to and continuously improve insider risk playbooks and working groups
• Support the design and tuning of detection use cases and monitoring baselines to improve identification of anomalous insider behavior
• Track metrics for leadership, with the intention of highlighting trends and improvement opportunities
• Support security operations efforts as capacity allows, given the close working relationship between insider risk and the broader security operations functions

Skills

Insider risk

Security operations

Digital forensics

Incident response

AI in security

Tools

SIEM

UEBA

EDR

Cloud forensics

Job description

BILL is hiring a Staff Insider Risk Engineer to join the Security Operations Center to support insider risk and digital forensics. You will help protect data, systems, and employees by designing detection use cases, triaging alerts, and collaborating with People, Legal, and Safety teams.

The role blends security operations, forensics, and AI-assisted workflows to drive informed security decisions and continuous improvement of playbooks.