Senior Insider Risk Engineer — Remote & Playbook Lead

Zscaler; United States; Remote; USD 134,000 - 168,000; Full time

Benefits offered by this job

Remote within the United States

Health benefits

Parental leave

Education reimbursement

Job summary

zscaler seeks a senior individual contributor on the Insider Risk team within Enterprise Security. You will strengthen detection capabilities, lead complex investigations, and translate casework into durable playbooks and processes.

This fully remote role is within the United States and partners closely with HR, Legal, and business leadership on sensitive matters. Responsibilities include tuning detection logic, conducting end-to-end investigations using EDR/XDR, UEBA, SIEM; author playbooks;

Qualifications

• 6+ years of hands-on experience in insider risk, data protection, fraud investigation, or security operations.
• Ownership of detection frameworks, playbooks, and end-to-end case disposition.
• Experience managing alerts inside a SIEM or SOAR platform.
• Proficiency in Python or JavaScript and automation in investigative workflows.
• Foundational understanding of AI/ML concepts in security.
• Strong written and verbal communication; ability to engage cross-functionally with discretion.
• U.S. citizenship.

Responsibilities

• Tune and refine insider risk detection logic to reduce noise, close coverage gaps, and surface high-fidelity alerts in a timely manner.
• Conduct endpoint and user activity investigations using EDR/XDR, UEBA, and SIEM tooling, managing cases end-to-end and building factual timelines.
• Author, maintain, and iterate insider risk investigation playbooks, capturing repeatable patterns from real cases.
• Act as a primary liaison with HR, Legal, and executive stakeholders during active matters, producing clear and defensible documentation.
• Mentor junior analysts and help mature the team's operating model.

Skills

Python

JavaScript

Automation in investigations

Investigation leadership

Detection frameworks

Strong communication

US citizenship

Tools

SIEM

SOAR

EDR/XDR

Playbooks automation

Job description

zscaler seeks a senior individual contributor on the Insider Risk team within Enterprise Security. You will strengthen detection capabilities, lead complex investigations, and translate casework into durable playbooks and processes.

This fully remote role is within the United States and partners closely with HR, Legal, and business leadership on sensitive matters. Responsibilities include tuning detection logic, conducting end-to-end investigations using EDR/XDR, UEBA, SIEM; author playbooks;