Remote Staff Insider Threat & Forensics Engineer

Cribl; Columbia (SC); Hybrid; USD 128,000 - 200,000; Full time

Benefits offered by this job

Health

Dental

Vision

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Job summary

Cribl is seeking a staff-level investigator at the intersection of insider threat, digital/hardware forensics, and executive protection. This hybrid role leads complex investigations end-to-end, briefs executives, and shapes mature insider risk, forensics, and physical security programs.

Requires 7+ years across investigations, forensics, and protection, hands-on tooling (EnCase/FTK/Cellebrite/X-Ways), and an IACIS CFCE or equivalent certification. Travel may be required at short notice.

Qualifications

• 7+ years of experience across insider threat investigations, digital/hardware forensics, and physical/executive protection (or a combination demonstrating equivalent depth)
• Demonstrated experience serving as lead investigator on insider risk cases involving sensitive, high-stakes, or legally exposed matters
• Working knowledge of employment law, HR investigation standards, and confidentiality requirements as they apply to internal investigations
• Hands-on forensic skills with standard tooling (e.g., EnCase, FTK, Cellebrite, X-Ways) and hardware-level forensic techniques
• Active or recent certification through IACIS (CFCE) or comparable digital forensics credentialing body
• Prior experience in executive protection, including travel risk assessment/intelligence gathering and direct coordination with executive support staff
• Excellent judgment and discretion; ability to hold confidentiality under pressure and manage competing stakeholder interests
• Strong written and verbal communication skills, including the ability to translate technical forensic findings for non-technical, legal, and executive audiences
• Willingness and ability to travel on short notice, including internationally

Responsibilities

• Lead insider risk investigations from initial detection through closure, including scoping, evidence collection, interviews, findings, and remediation recommendations
• Partner closely with HR, Legal, and Employee Relations to ensure investigations are conducted defensibly, confidentially, and in compliance with employment law and privacy requirements
• Build and mature insider risk program components: detection use cases, escalation criteria, case management workflows, and cross-functional playbooks
• Brief sensitive findings to senior stakeholders (Legal, HR, executive leadership) with appropriate discretion and documentation
• Conduct forensic acquisition and analysis of laptops, mobile devices, removable media, and network artifacts in support of investigations
• Maintain chain of custody and produce forensically sound, litigation-ready documentation
• Perform hardware-level forensics (disk imaging, device teardown/analysis, embedded storage) in addition to standard digital forensics
• Apply and maintain relevant certifications (IACIS CFCE or equivalent; EnCE, GCFE, or similar strongly preferred)
• Provide executive protection coverage for principals during domestic and international travel and at company events and conferences
• Lead security planning for company conferences and events
• Conduct pre-travel intelligence and risk assessments to inform protective planning
• Coordinate directly with executive assistants on itineraries, logistics, and advance planning to ensure protection is seamless
• Support physical security assessments of office locations, facilities and events, identifying and mitigating potential vulnerabilities

Skills

Insider threat investigations

Digital forensics

Executive protection

Legal/privacy compliance

Travel risk assessment

Tools

EnCase

FTK

Cellebrite

X-Ways

Job description

Cribl is seeking a staff-level investigator at the intersection of insider threat, digital/hardware forensics, and executive protection. This hybrid role leads complex investigations end-to-end, briefs executives, and shapes mature insider risk, forensics, and physical security programs.

Requires 7+ years across investigations, forensics, and protection, hands-on tooling (EnCase/FTK/Cellebrite/X-Ways), and an IACIS CFCE or equivalent certification. Travel may be required at short notice.