Remote Insider Threat Engineer - CSIRT & Threat Hunting

Piper Companies; United States; Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health benefits

Vision benefits

Dental benefits

Paid time off

Paid holidays

Job summary

Piper Companies is seeking an Insider Threat Security Engineer to join a leading technology organization on a long-term contract. This role can be performed remotely within the United States as part of the CSIRT, focusing on identifying, investigating, and mitigating internal security threats across the enterprise.

The ideal candidate will bring 8+ years in cybersecurity with hands-on SIEM experience (Splunk, QRadar, LogRhythm, Microsoft Sentinel, Elastic) and strong networking knowledge.

Qualifications

• 8+ years of experience in cybersecurity, incident response, threat hunting, security operations, or insider threat programs.
• Hands-on experience with Splunk or comparable SIEM platforms such as QRadar, LogRhythm, Microsoft Sentinel, or Elastic.
• Ability to create and modify SPL queries from scratch.
• Experience utilizing UBA and/or UEBA solutions to investigate suspicious user activity.
• Strong understanding of networking concepts including TCP/IP, DNS, routing, switching, and network security fundamentals.

Responsibilities

• Investigate actual and suspected insider security incidents as part of the CSIRT.
• Conduct threat hunting activities and proactively identify anomalous user behavior across the enterprise environment.
• Lead incident response efforts including investigation, containment, remediation, and documentation of security events.
• Develop, optimize, and maintain SIEM detections and custom SPL queries to identify suspicious activity.
• Utilize UBA/UEBA tools to detect insider threats and reduce organizational risk.
• Collaborate with infrastructure, networking, and security teams to investigate complex incidents and improve detection capabilities.
• Analyze logs, network traffic, system activity, and endpoint telemetry to support investigations and security monitoring efforts.

Skills

Threat hunting

Incident response

Security operations

Insider threat

Networking fundamentals

Tools

Splunk

QRadar

LogRhythm

Microsoft Sentinel

Elastic

Job description

Piper Companies is seeking an Insider Threat Security Engineer to join a leading technology organization on a long-term contract. This role can be performed remotely within the United States as part of the CSIRT, focusing on identifying, investigating, and mitigating internal security threats across the enterprise.

The ideal candidate will bring 8+ years in cybersecurity with hands-on SIEM experience (Splunk, QRadar, LogRhythm, Microsoft Sentinel, Elastic) and strong networking knowledge.