Sr Engineer, Cyber Insider Threat - Network Activity Logs - Remote

Lensa; Buffalo (NY); Remote; USD 80,000 - 189,000; Full time

Job summary

A leading career site is seeking a Sr Engineer for the Cyber Insider Threat program, focusing on advanced monitoring and detection strategies. The role requires collaboration with cybersecurity teams to implement innovative solutions and conduct thorough analyses of user activity to prevent insider threats. Candidates should possess a strong background in cybersecurity, data analytics, and relevant programming skills.

Qualifications

• 6+ years in cybersecurity or investigative analysis.
• Proficient in programming/scripting languages like Python or Java.
• Experience with insider threat tools and data analytics.

Responsibilities

• Lead design and implementation of insider threat monitoring strategies.
• Collaborate with cybersecurity teams to enhance detection capabilities.
• Conduct in-depth analysis of logs from various data sources.

Skills

Leadership

Communication

Data Analytics

Cybersecurity

Insider Threat Concepts

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

UEBA

SIEM

DLP

EDR

SQL

Job description

Sr Engineer, Cyber Insider Threat - Network Activity Logs - Remote

1 day ago Be among the first 25 applicants

Lensa is the leading career site for job seekers at every stage of their career. Our client, Molina Healthcare, is seeking professionals. Apply via Lensa today!

Job Description

Job Summary

The Sr Engineer, Insider Threat will implement cyber intelligence (CyInt) collection, compilation, and analysis for the insider threat program. Implements data sets, tools, and provides program support to insider threat analysts and investigations. Works closely with our cybersecurity team, other technical teams, and business stakeholders to develop advanced insider threat systems and processes.

Job Duties

1. Lead the design, development, and implementation of a comprehensive insider threat monitoring and detection strategy integrating technical and non-technical components
2. Collaborate with cybersecurity analysts, engineers, and other program stakeholders to develop and refine insider threat monitoring and detection capabilities
3. Correlate information from multiple technical user activity monitoring (UAM), user entity behavior analytics (UEBA), data loss prevention (DLP), security information and event management (SIEM), and non-technical data sources to enable proactive insider risk/threat detection
4. Utilize cybersecurity expertise, knowledge of insider threat detection, and data analytics to create innovative strategies for detecting and preventing malicious activities.
5. Conduct in-depth analysis of logs received from various data sources
6. Architect and implement automation of investigation and escalation workflows
7. Contribute to internal investigations by providing support for forensic analysis, log review, and alert analysis
8. Execute rigorous testing on internal security mechanisms to validate their effectiveness
9. Develop and maintain insider risk techniques and procedures, including use cases surrounding data exfiltration, internal fraud, privilege escalations, and sabotage
10. Evaluate, recommend, and improve existing technical and non-technical solutions to detect and respond to potential insider threats
11. Guide the technical architecture of insider threat systems, ensuring alignment with organizational security and business goals
12. Publish internal CyInt threat intelligence products and briefings to provide actionable information to stakeholders
13. Define security controls and metrics to measure the effectiveness of the insider threat program
14. Stay abreast of emerging insider threat trends and update strategies accordingly
15. Coordinate with stakeholders on CyInt activities to ensure compliance with policies and regulations

Job Qualifications

REQUIRED QUALIFICATIONS:

• Bachelor’s degree in computer science, Cybersecurity, Information Systems, or equivalent education or work experience
• Expert understanding of cybersecurity and insider threat concepts, protocols, and tools
• Experience with UEBA deployment, administration, data source integrations, and configurations
• Strong knowledge of data protection and privacy regulations
• Proficient in at least one programming or scripting language such as Java, Python, .NET, JavaScript, or C+
• Experience in scripting languages such as PowerShell, Perl, or Bash
• Exceptional leadership, communication, and presentation skills
• At least 6 years of experience in cybersecurity, DLP, Security Operations, investigative analysis, or the intelligence field
• Experience leading or conducting technical investigations utilizing insider threat tools
• Ability to professionally manage confidential matters with appropriate judgment around escalation
• Experience with data analytics tools used for insider threat information collection and knowledge of other insider threat risk scoring data analytics tools
• Action-oriented engineer with the ability to work autonomously and take ownership of complex projects
• Experience developing and implementing defensive controls around Windows, MacOS, Linux, and SaaS applications
• Proficiency with automating workflows and integrating security tools within IT environments

Preferred Qualifications

• Experience with UEBA/SIEMs
• Experience with Endpoint Detection and Response (EDR) tools, device management tooling, and other telemetry sources
• Experience working on insider threat teams or working insider threat investigations
• Experience with broad system forensics
• Experience communicating technical security concerns and issues to a non-technical audience
• Experience with insider threat tools (e.g., Red Vector, Code42, Exabeam, DTEX)
• Prior experience working with confidential/sensitive information
• Familiarity with cybersecurity, networking, internet fundamentals (TCP/IP, BGP, DNS), digital forensics, and data exfiltration methods
• Experience using Excel or SQL for complex data analysis
• Experience developing PowerPoint presentations
• Relevant security or cybersecurity certifications (e.g., Security+, CISSP, CISM, CERT Insider Threat, CEH)

Pay Range: $80,412 - $188,164 / ANNUAL

• Actual compensation may vary based on location, experience, education, and skills.

Seniority level

• Mid-Senior level

Employment type

• Full-time

Job function

• Engineering and Information Technology

Industries

• IT Services and IT Consulting