The Insider Risk Security Engineer joins the Information Security Insider Risk team to protect data from risks associated with individuals who have authorized access. This role focuses on building insider risk capabilities, driving tooling requirements to identify anomalous user activities, and providing support during active incidents. You will implement and maintain Insider Risk Management technologies, fine-tune DLP rules to minimize false positives, and collaborate with IT, HR, and Legal teams to refine security policies. The position requires expertise in cloud security, UEBA tools, and Microsoft E5 products. Candidates should possess skills in KQL, YARA, Regex, JSON, and Lucene Query Syntax. This role addresses the specific challenge of protecting against nation-state actors, negligent behavior, and malicious employee activity within a global semiconductor environment by leveraging technical expertise to detect and mitigate human-risk compromises.
Implement, maintain, and troubleshoot Insider Risk Management (IRM) technologies, policies, and rules across the organization.
Define and refine security policies in coordination with IT, HR, and Legal teams to protect sensitive data.
Fine-tune IRM and Data Loss Prevention (DLP) rules to minimize false positives and improve detection accuracy.
Develop innovative use cases designed to detect anomalous user activities and indicators of risk.
Provide technical expertise and guidance as the primary escalation point for insider risk inquiries.
Analyze security trends and metrics to provide insights into the performance of the IRM ecosystem.
Support active incidents by identifying risks from nation-state actors, negligent activity, or malicious intent.
What we're looking for
Bachelor's degree in Computer Science, Cybersecurity, Information Security, Information Technology, Counterintelligence, or a related discipline.
5+ years of experience as a security engineer familiar with typical DLP and UEBA tools.
Proven experience implementing, troubleshooting, and administering Insider Risk and DLP technologies in a global enterprise.
Experience with cloud security and cloud-based applications.
Excellent problem-solving skills and the ability to work independently.
Outstanding communication skills for effective collaboration across different teams and stakeholders.
Certifications such as CISSP, CISM, or CEH (preferred).
Formal education in insider risk/counterintelligence, knowledge of Microsoft E5 products, KQL, YARA, Regex, JSON, Lucene, behavioral analysis, or semiconductor industry experience (preferred).
Silverfort
Microsoft Defender for Identity
Microsoft Defender for Endpoint
Microsoft Defender for Cloud
Microsoft Purview
Netskope
Palo Alto Networks
Imperva
Perception Point
Microsoft Intune
Security Copilot
IAM
DLP
EPM
WAF
CSPM
SIEM
SOAR
Vulnerability Management