Senior Insider Threat Analyst

Jobtailor; Brooklyn (OH); On-site; USD 120,000 - 180,000; Full time

Job summary

KeyBank is seeking an experienced Insider Threat Analyst to conduct investigations and proactive threat hunts across endpoints, networks, and cloud environments. You will develop use cases and detections using UEBA, UAM, SIEM, and related technologies, preserve evidence, and present findings to HR, Legal, and stakeholders.

The role requires strong analytical and writing skills, 5+ years in insider threat or threat hunting, and deep knowledge of MITRE ATT&CK.

Qualifications

• Bachelor's degree or equivalent experience in CS/Cybersecurity.
• 5+ years in Insider Threat or Threat Hunting roles.
• Strong analytical, research, and writing skills.
• Proficiency with Insider Threat tools and log analysis; MITRE ATT&CK knowledge.
• Preferred certifications: GCTI, GCFA, CISSP, CySA+, or Security+.

Responsibilities

• Conduct insider threat investigations and comprehensive monitoring and analysis of indicators.
• Develop insider threat use cases and detections using UEBA, UAM, SIEM, or similar technologies.
• Preserve evidence, prepare detailed reports, and present findings to HR, Legal, and stakeholders.
• Design and execute proactive threat hunts across endpoints, networks, and clouds.
• Build proactive detections and alerts based on attacker TTPs and threat intel.
• Analyze logs from Windows, Linux, cloud environments, and SIEM platforms.
• Evolve Insider Threat and Threat Hunt programs with best-practice guidance and metrics.
• Apply MITRE ATT&CK and other frameworks to enhance detection and response.
• Use Python, APIs, STIX/TAXII, and automation to improve intelligence gathering.
• Produce threat assessments and briefings for technical and non-technical stakeholders.
• Collaborate with CTM, Cyber Defense, security, HR, and business partners.
• Participate in incident response, tabletop exercises, and red/blue/purple team activities.
• Provide mentorship and technical guidance to junior analysts.

Skills

Insider Threat Investigation

Threat Hunting

MITRE ATT&CK

Log Analysis

Python Programming

Education

Bachelor's degree in CS/Cybersecurity

Tools

UEBA

UAM

SIEM

XDR

APIs

STIX/TAXII

Cloud Environments

Windows

Linux

Job description

• Conduct sensitive insider threat investigations and comprehensive monitoring and analysis of insider threat indicators
• Develop insider threat use cases and detections using UEBA, UAM, SIEM, or similar technologies
• Preserve evidence, prepare detailed reports, and present findings to HR, Legal, and other stakeholders
• Design and execute proactive, hypothesis-driven threat hunts across endpoints, networks, and cloud environments
• Build proactive detections and alerts based on attacker TTPs, threat intelligence, and analytical insights
• Analyze logs from Windows, Linux, cloud environments, network devices, XDR, and SIEM platforms
• Evolve Insider Threat and Threat Hunt programs through best-practice advice, documentation, metrics, and process/tool improvements
• Apply MITRE ATT&CK and other frameworks to enhance detection and response
• Use Python, APIs, STIX/TAXII, and automation to improve intelligence gathering and processing
• Produce threat assessments, written reports, and briefings for technical and non-technical stakeholders
• Collaborate with CTM, Cyber Defense, security, technology, fraud, HR, and business-line partners
• Participate in technical incident response, tabletop exercises, and red/blue/purple team activities
• Provide mentorship and technical guidance to junior analysts and cross-functional partners
• Help strengthen KeyBank's overall threat posture and foster continuous learning

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, or related field, or equivalent experience
• 5+ years of experience in Insider Threat and/or Threat Hunting roles
• Strong analytical, research, and writing skills
• Proficiency with Insider Threat and Threat Hunting tools and log analysis
• Deep understanding of MITRE ATT&CK and adversary TTPs
• Strong ability to communicate concisely and effectively with executive management
• Ability to work independently and elevate risks appropriately
• Preferred certifications: GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Forensic Analyst (GCFA), CISSP, CompTIA CySA+, or CompTIA Security+

Core Competencies

Demonstrates expertise in conducting insider threat investigations and threat hunting, utilizing tools such as UEBA, UAM, and SIEM. Proficient in applying MITRE ATT&CK frameworks and producing detailed reports for diverse stakeholders.

Highest-signal resume keywords

• Insider Threat Investigation
• Threat Hunting
• MITRE ATT&CK Framework
• Log Analysis
• Python Programming

ATS Optimization Keywords

Hard Skills

• Insider Threat Tools
• Threat Detection
• Data Analysis
• Evidence Preservation
• Report Writing
• Threat Intelligence
• Analytical Insights
• Automation
• Hypothesis-Driven Threat Hunts
• TTP Analysis

Soft Skills

• Analytical Skills
• Communication Skills
• Mentorship
• Collaboration
• Independent Work

Certifications & Qualifications

• GIAC Cyber Threat Intelligence (GCTI)
• GIAC Certified Forensic Analyst (GCFA)
• CISSP
• CompTIA CySA+
• CompTIA Security+

Industry Keywords

• Insider Threat
• Threat Hunting
• Cybersecurity
• Incident Response
• Threat Posture
• Continuous Learning
• Stakeholder Engagement
• Technical Guidance
• Red/Blue/Purple Team Activities
• Tabletop Exercises

Tools & Technologies

• UEBA
• UAM
• SIEM
• XDR
• APIs
• STIX/TAXII
• Cloud Environments
• Network Devices
• Windows
• Linux