Remote Senior Insider Threat Detection & Response Engineer

Ektello; San Francisco (CA); Remote; USD 138,000 - 207,000; Full time

Job summary

Ektello is seeking a Sr. Security Engineer focused on Insider Threat Detection & Response. This fully remote role involves building and scaling insider threat detection capabilities, automating detections, and driving incident response readiness across the organization.

Responsibilities include threat hunting, creating detection models, and collaborating with HR, Legal, and Privacy to manage sensitive internal cases while maintaining security posture in a fast-growing environment.

Qualifications

• 5+ years in security operations: detection, threat hunting, IR, forensics, or threat intel.
• Bachelor’s degree in CS, InfoSec, or related field (or equivalent).
• Deep experience with insider threat tech: DLP, UEBA, UAM.
• Familiarity with MITRE ATT&CK and cyber kill chain.
• Automate security detection and response with code (Python/SQL).

Responsibilities

• Detection Engineering & Visibility: identify coverage gaps; onboard logging; build scalable detections for data abuse and exfiltration.
• Threat Hunting & Analytics: use data analytics to hunt for insider threats and policy violations at scale.
• Automation & Modeling: build automation pipelines, detection models, and UEBA logic.
• Complex Investigations & Partnerships: technical investigations with engineering; work with HR, Legal, Privacy on sensitive cases.
• Countermeasure & Strategy Design: design security controls and risk mitigation for high-risk internal access.
• Incident Response & On-Call: participate in 24/7 on-call rotations for incidents.
• Security Culture & Awareness: contribute technical context to security awareness messaging.

Skills

Threat detection

Threat hunting

Incident response

Code automation

Communication

Education

Bachelor's degree in CS/InfoSec or related field

Tools

DLP

UEBA

UAM

AWS

Job description

Ektello is seeking a Sr. Security Engineer focused on Insider Threat Detection & Response. This fully remote role involves building and scaling insider threat detection capabilities, automating detections, and driving incident response readiness across the organization.

Responsibilities include threat hunting, creating detection models, and collaborating with HR, Legal, and Privacy to manage sensitive internal cases while maintaining security posture in a fast-growing environment.